CVE-2026-116180

A flaw was found in vLLM. A remote client sharing the inference engine can trigger a Denial of Service DoS by submitting requests with prompt log probabilities enabled against a cached prefix. Because uninitialized memory is allocated for log probability tensors, cached token positions remain...