CVE Alert: CVE-2026-116180 – vllm-project

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests.

**Risk verdict:** This is a high-impact availability risk for shared inference services; urgency rises where the service is internet-reachable, though KEV, SSVC, PoC and EPSS status are not provided.

**Why this matters:** A low-privilege tenant could disrupt inference for other customers, causing service interruption, failed requests and possible SLA breaches. The likely goal is denial of service rather than data theft or tampering; repeated disruption could also increase operational costs and undermine tenant isolation.

**Most likely attack path:** A network-accessible client with low-level access sends a request using prompt-logprob or echo functionality against a prefix cached by the KV connector. No user interaction or complex setup is indicated; the resulting engine failure can affect co-tenants, so impact extends beyond the initiating request.

**Who is most exposed:** Prioritise multi-tenant GPU inference platforms and hosted model APIs using the affected engine with KV-prefix caching. Single-tenant or isolated deployments have less cross-customer exposure, but may still suffer service interruption.

Alert on engine-worker exits or restarts correlated with logprob-enabled requests.

Inspect request logs for prompt-logprob or echo options and cached-prefix usage.

Track sudden co-tenant request failures, queue backlogs and availability drops.

Mitigation and prioritisation:

Upgrade to the fixed release or later; verify the deployed runtime, not just the package manifest.

Until patched, restrict logprob/echo options and disable connector prefix caching where practical.

Limit tenant access and isolate engines for sensitive workloads; test controls for inference regressions.

Schedule an expedited change, with rollback and service-health checks; confirm KEV, SSVC and EPSS status to refine urgency.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.