EUVD-2026-109435
GHSA-6gg7-pp4x-7486
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Rust gRPC Generate/GenerateStream endpoint
-
ExploitSubmit prompt.token_ids with out-of-vocabulary ID
-
ImpactFatal EngineCore embedding lookup terminates server (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | The deployment must expose the vLLM Rust gRPC Generate or GenerateStream service and be network-reachable to the attacker; the attacker submits a pre-tokenized prompt via the protobuf TokenIds field (prompt.token_ids) containing an out-of-vocabulary ID (e.g., 9000000) that exceeds the union of tokenizer and model vocabulary bounds. Only vLLM 0.22.0 through 0.23.x running the Rust gRPC frontend are affected - the Rust OpenAI (/v1/completions, /v1/chat/completions) and HTTP (/inference/v1/generate) routes already validate token IDs and are not the sink here. Per CVSS PR:N no authentication or user interaction is required; the primary limiting factor is reachability of the gRPC endpoint - if a deployment restricts gRPC to already-authorized clients, exploitation requires that access (the advisory models this as PR:L, CVSS 6.5). |
| Impact | This is a single-request denial-of-service affecting only availability (VA:H; VC:N/VI:N - no confidentiality or integrity impact). The NVD CVSS 4.0 vector scores 8.2 using AC:H/AT:P, but that is inconsistent with the mechanism described: the advisory shows a trivial, fully attacker-controlled trigger (a single out-of-vocabulary prompt token ID such as 9000000), which implies low attack complexity and no special attack requirement - the vendor's own suggestion of CVSS:3.1 AV:N/AC:L/PR:N/UI:N/A:H (7.5) is a better fit. Exploitation status is 'no public exploit identified at time of analysis' (no KEV listing, no EPSS supplied, and the two references are vendor/VulnCheck advisories, not verified working exploit code). The vuln.today decision label is 'this_week' rather than act_now/emergency. Net assessment: a genuine, easy-to-trigger availability bug worth patching promptly, but not an active-exploitation emergency; real-world risk hinges almost entirely on whether the Rust gRPC Generate/GenerateStream endpoint is network-reachable without an additional deployment-layer credential - many deployments keep this surface internal, which materially reduces exposure. |
| Exploit ScenarioDerived | An attacker able to reach an exposed vLLM Rust gRPC endpoint sends a Generate or GenerateStream request whose pre-tokenized prompt (protobuf TokenIds field) contains an out-of-vocabulary token ID such as 9000000; the unchecked ID reaches the EngineCore embedding lookup and causes a fatal failure that leaves the server unhealthy. No public working exploit code is identified, though the advisory documents the exact trigger value and an analogous crash on the Rust HTTP sibling route (PR #45441). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 25, 2026
A single crafted request to the Rust gRPC Generate or GenerateStream service in vLLM 0.22.0 through 0.23.x can abort EngineCore and leave the inference server unhealthy, producing a remote denial of service against availability only. Because the gRPC handlers forward attacker-supplied pre-tokenized prompt IDs to the engine without checking them against tokenizer or model vocabulary bounds, an out-of-vocabulary value such as 9000000 reaches the embedding lookup and terminates the process; no confidentiality or integrity impact is assessed. The vendor shipped a fix in 0.24.0, and no public exploit code has been identified at time of analysis - the main gating factor is whether the gRPC endpoint is network-reachable, since the advisory notes that deployments restricting it to already-authorized clients require that access and would score lower (PR:L, 6.5).
RemediationAI
Upgrade vllm to 0.24.0 or later (Vendor-released patch: 0.24.0), which adds the same token-id range validation used by the Rust OpenAI and HTTP generate routes to the gRPC Generate and GenerateStream handlers so out-of-vocabulary prompt token IDs, allowed_token_ids and logit_bias keys are rejected with an INVALID_ARGUMENT status before any engine request is submitted. If the upgrade cannot be applied immediately, the actionable compensating control is to restrict network reachability of the Rust gRPC listener to trusted clients with a deployment-layer credential or network policy, since the exploitability of this issue depends on the gRPC endpoint being reachable; the trade-off is that any client still admitted can reproduce the EngineCore abort, which the advisory models as the PR:L / 6.5 case rather than eliminating the flaw. Alternatively, route generation traffic through the Rust HTTP /inference/v1/generate or OpenAI-compatible endpoints, which already validate token IDs, and keep the gRPC service disabled until 0.24.0 is deployed - at the cost of losing the gRPC interface for existing clients. Details are in the vendor advisory at https://github.com/vllm-project/vllm/security/advisories/GHSA-w2v2-5662-8v5q.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vLLM's Rust front end exposes a protobuf service defined in rust/proto/vllm_grpc.proto whose oneof prompt accepts either a string text (field 3) or a TokenIds message (field 4). The gRPC conversion layer in rust/src/server/src/grpc/convert.rs maps prompt.token_ids straight into Prompt::TokenIds, and rust/src/text/src/lib.rs deliberately bypasses tokenization for pre-tokenized prompts, so the IDs flow into rust/src/model/src/request.rs as prompt_token_ids and reach EngineCore unchanged. There is no gRPC-side analogue of the token-id range validators used by the Rust OpenAI routes (rust/src/server/src/routes/openai/utils/token_ids.rs), which already reject prompt token IDs, allowed_token_ids and logit_bias keys outside vocabulary bounds; PR #44680 added that validator family to /v1/completions and /v1/chat/completions and PR #45441 extended it to the Rust HTTP /inference/v1/generate route, but neither touches rust/src/server/src/grpc/*. The root cause is CWE-20 improper input validation (with CWE-400 uncontrolled resource consumption as a secondary classification): an unchecked, out-of-vocabulary token ID is accepted as valid client input and triggers a fatal embedding lookup failure in the shared engine rather than being rejected with an INVALID_ARGUMENT gRPC status before submission. The trigger is precisely described in the advisory; the CVSS 4.0 vector's AC:H/AT:P reflects the preconditions around reachability and request construction rather than any race or memory-safety condition.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
A single attacker-controlled out-of-vocabulary token reliably crashes EngineCore, so AC:L and no auth/UI (PR:N/UI:N) for a network-reachable gRPC endpoint; impact is availability-only (A:H, C/I:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.
Technical POC Analysis
CWE-20 (Improper Input Validation), with CWE-400 as a secondary characterization.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A critical availability flaw in vLLM versions 0.22.0 through 0.23.x allows an unauthenticated attacker to remotely crash the inference engine with a single crafted request. This can cause service outages and disrupt AI-dependent operations, impacting customers and internal users. Leadership should prioritize remediation to maintain service reliability and avoid potential SLA breaches.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB