CVE-2026-116173 vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids

vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprobtokenids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with outputlogprobs enabled and more than 128...

CVE-2026-116173

The vLLM library versions 0.22.0 before 0.24.0 is vulnerable to a Denial of Service (DoS) attack due to improper input validation in the Rust gRPC frontend. A remote attacker can terminate the EngineCore by sending Generate or GenerateStream requests with output_logprobs enabled and more than 128...