vLLM CVE-2026-116173

Exploitation requires that the deployment expose the vLLM Rust gRPC frontend (the Generate / GenerateStream API) and that the attacker can send it a request. The concrete trigger is a request with ResponseOptions.output_logprobs = true and output_candidates.token_ids set to a list of more than 128 token IDs; the Rust converter lowers this into SamplingParams.logprob_token_ids without any length, vocabulary, or logprobs-count consistency check. Limiting factors: only the Rust gRPC path is affected (the Python SamplingParams validator and HTTP/OpenAI-style paths enforce the 128 cap, so those are not vulnerable), the engine must be running the V1 GPU logprob sampler path, and realistic risk depends on whether the gRPC endpoint is network-reachable to untrusted callers versus gated behind a deployment-layer credential. Impact is limited to availability (engine crash); no data access or code execution.

Signals point to a genuine but bounded availability risk. The impact is confirmed single-request denial of service - an uncaught sampler exception terminates EngineCore - with no confidentiality or integrity impact (VC:N/VI:N, VA:H). The input CVSS 4.0 vector (8.2) and the GHSA writeup conflict on exploitation difficulty: the official vector encodes AC:H/AT:P (high complexity, present attack requirement), but the advisory's own technical analysis and its suggested CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H describe a trivial, deterministic single-request trigger with no race, timing, or attacker-uncontrolled precondition - so AC:H/AT:P appears unjustified by the described mechanism and should be verified with the CNA. Authentication is ambiguous: PR:N applies if the Rust gRPC endpoint is network-reachable without a deployment-layer credential, but the advisory explicitly offers a conservative PR:L model where the surface is reachable only by already-authorized clients; no vector field resolves this, so the real priority depends on local network exposure. No EPSS score and no CISA KEV entry were provided, and no public exploit is identified in the input. Net: a real, easy-to-trigger DoS worth patching on the vuln.today 'this_week' cadence, but not an actively-exploited emergency; its practical severity hinges on whether the gRPC frontend is exposed to untrusted callers.

An attacker able to reach a vLLM Rust gRPC frontend sends a single Generate or GenerateStream request with output_logprobs enabled and an output_candidates.token_ids list containing 129 or more IDs. The Rust converter lowers the oversized list into SamplingParams.logprob_token_ids without the Python MAX_LOGPROB_TOKEN_IDS=128 check, so the request enters execution and the GPU logprob sampler raises a fatal exception that EngineCore treats as a fatal engine error, crashing the engine. No public exploit is identified at time of analysis, though the advisory documents the exact triggering request.