CVE-2026-116174 | vllm-project vLLM up to 0.23.x Rust gRPC Generate/GenerateStream service prompt.token_ids input validation

October 25, 2026 Yanac

A vulnerability classified as problematic has been found in vllm-project vLLM up to 0.23.x. Affected by this issue is the function Generate/GenerateStream of the component Rust gRPC Generate/GenerateStream service. This manipulation of the argument prompt.token_ids causes improper input validation.

The identification of this vulnerability is CVE-2026-116174. It is possible to initiate the attack remotely. There is no exploit available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More