CVE WATCH / VULNERABILITY DETAIL
CVE-2026-116173
MEDIUMCVSS 5.9NVD feed
Published 25 October 2026 · tracked since 25 October 2026
Description
vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with output_logprobs enabled and more than 128 output
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-116063 MEDIUM 4.7
- CVE-2026-116061 HIGH 7.3
- CVE-2026-116062 HIGH 7.3
- CVE-2026-116060 HIGH 7.3
- CVE-2026-116057 MEDIUM 6.3
- CVE-2026-116056 MEDIUM 6.3
- CVE-2026-116055 MEDIUM 6.3
- CVE-2026-116204 HIGH 8.1
- CVE-2026-116207 CRITICAL 9.1
- CVE-2026-116189 HIGH 7.5