Executive Intelligence Brief

A critical denial of service (DoS) vulnerability, CVE-2026-116180, has been discovered in vLLM, affecting versions from 0.8.5 to before 0.31.0. This vulnerability allows an attacker to crash the EngineCore, impacting co-tenant requests, with a CVSS score of 7.7, indicating high severity. The vulnerability is not actively exploited but requires immediate attention to prevent potential disruptions. Patching to version 0.31.0 or later is strongly recommended.

Threat Overview

vLLM is an open-source platform used for serving AI models, known for its scalability and performance. It is widely used in production environments for deploying machine learning models. The vulnerability affects the core functionality of vLLM, specifically in how it handles prompt log probabilities, which are used in AI model interactions.

Historically, vLLM has not been associated with significant vulnerabilities, but this incident highlights the importance of securing AI model serving platforms. The vulnerability was discovered and reported by the vLLM project team itself, demonstrating proactive vulnerability management.

Technical Deep Dive

Vulnerability Classification

The vulnerability is classified as CWE-908, which relates to Denial of Service attacks. This class of vulnerability occurs when an attacker can cause a service to become unavailable, often by crashing the service or consuming excessive resources.

The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, indicating:

  • Attack Vector: Network (AV:N)
  • Attack Complexity: Low (AC:L)
  • Privileges Required: Low (PR:L)
  • User Interaction: None (UI:N)
  • Scope: Changed (S:C)
  • Confidentiality Impact: None (C:N)
  • Integrity Impact: None (I:N)
  • Availability Impact: High (A:H)

Root Cause Analysis

The root cause of the vulnerability lies in the LogprobsTensors.empty_cpu() function in vllm/v1/outputs.py. This function allocates an uninitialized int32 tensor. Additionally, the V1 model runner does not properly handle prompt positions reported by a KV connector, leaving them unwritten. An attacker can exploit this by sending a specially crafted prompt_logprobs request against a connector-cached prefix, causing a tokenizer.decode to raise an OverflowError. This error crashes the EngineCore and drops all co-tenant requests.

Attack Vector & Chain

The attack vector involves a low-privileged attacker sending a malicious request to the vLLM service. The attack complexity is low because the attacker only needs to craft a specific request to trigger the vulnerability. The attack requires no user interaction and can impact the availability of the service significantly.

Exploitation Scenario Walkthrough

Scenario: Denial of Service via Malicious Prompt Logprobs Request

Reconnaissance: An attacker identifies a vulnerable version of vLLM (between 0.8.5 and 0.31.0) running on a target network.

Weaponization: The attacker crafts a malicious prompt_logprobs request designed to trigger the OverflowError in the tokenizer.decode function.

Delivery & Exploitation: The attacker sends the crafted request to the vLLM service. The service processes the request, causing the EngineCore to crash and drop all co-tenant requests.

Post-Exploitation: The attacker may attempt to exploit the service disruption caused by the crash, potentially demanding a ransom or further exploiting the service instability.

Impact Realization: The final impact is a denial of service, affecting all co-tenants sharing the EngineCore, leading to service disruption and potential financial losses.

Exploitation in the Wild

The vulnerability is not actively exploited at the time of disclosure. However, given its high severity and the potential for disruption, it is likely that attackers will focus on exploiting this vulnerability. Monitoring for suspicious requests and maintaining up-to-date versions are crucial.

Impact Analysis

Direct Impact

The direct impact of this vulnerability is a denial of service, which can lead to significant service disruptions. An attacker can cause the EngineCore to crash, affecting all co-tenants and leading to high availability impact.

Downstream & Cascading Effects

The downstream effects include potential financial losses due to service disruption, impact on dependent services, and reputational damage. The vulnerability's scope is changed (S:C), indicating that the impact can extend beyond the immediate target to other components or services.

Affected Products & Versions

The vulnerability affects vLLM versions from 0.8.5 to before 0.31.0. The fixed version is 0.31.0 and later.

  • Affected: vLLM 0.8.5 to 0.30.x
  • Fixed: vLLM 0.31.0 and later

Detection & Threat Hunting

Indicators of Compromise

Indicators of compromise (IoCs) may include:

  • Unusual prompt_logprobs requests
  • Error logs indicating OverflowError in tokenizer.decode
  • Crash reports from EngineCore

Detection Rules & Signatures

Detection logic may involve monitoring for:

  • Anomalous request patterns to the vLLM service
  • Specific error messages in logs

Conceptual SIEM/EDR detection logic:

if request contains 'prompt_logprobs' and response_code == 500 and log contains 'OverflowError'

Threat Hunting Queries

Threat hunting queries may include searching for:

  • Requests with prompt_logprobs in the last 24 hours
  • Error logs containing OverflowError or EngineCore crash messages

Remediation & Hardening

Immediate Actions (0-24 hours)

1. **Patch to version 0.31.0 or later**: Immediately upgrade vLLM to version 0.31.0 or later to fix the vulnerability.

2. **Monitor for suspicious requests**: Enhance monitoring to detect unusual prompt_logprobs requests.

Short-Term Hardening (1-7 days)

1. **Implement WAF rules**: Configure Web Application Firewall (WAF) rules to filter out malicious prompt_logprobs requests.

2. **Enhance logging and monitoring**: Increase log verbosity and monitoring to detect potential exploitation attempts.

Strategic Recommendations

1. **Regularly update dependencies**: Ensure all dependencies, including vLLM, are updated regularly to prevent similar vulnerabilities.

2. **Implement robust security controls**: Use robust security controls, such as network segmentation and least privilege access, to limit the impact of potential breaches.

Analyst Assessment

The vulnerability has a high CVSS score of 7.7, indicating significant risk. While not actively exploited, the potential for disruption is high. Organizations should prioritize patching and enhanced monitoring to mitigate this risk.

Sources