CVE-2026-116172

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass maxlogprobs limits via CandidateTokens.topn. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping topn values t...

CVE-2026-116172 vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass maxlogprobs limits via CandidateTokens.topn. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping topn values t...

EUVD-2026-109433

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass maxlogprobs limits via CandidateTokens.topn. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping topn values t...

CVE-2026-116172

The vLLM library (versions 0.22.0 to before 0.24.0 ) is vulnerable to a Denial of Service (DoS) attack due to improper input validation in the Rust gRPC converter . A remote attacker can bypass max_logprobs limits by sending Generate or GenerateStream requests containing oversized or integer-wrap...