CVE-2026-116180GHSA-rhcx-5729-88vg
vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors
vllm-project vllm
CVSS
8.3HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 0.31.0vllmCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests.
Text from CVE List
Affected versions 2
- vllmaffected: 0.8.5 before 0.31.0CVE List
- vllmunaffected: 0.31.0CVE List