Database/AI/ML frameworks & serving
vLLM Rust gRPC frontend: oversized CandidateTokens.top_n bypasses max_logprobs and kills EngineCore
Impact
The Rust gRPC converter does not validate CandidateTokens.top_n, so a caller can send a Generate or GenerateStream request with an oversized or integer-wrapping value that slips past the server's max_logprobs limit and makes torch.topk fail fatally, terminating EngineCore. The engine process dies and every concurrent request on that replica is dropped. For an operator the cost is a serving replica that must reload model weights into GPU memory before it is useful again, caused by one unauthenticated gRPC call. Three separate advisories cover different unvalidated fields in this same frontend (see also CVE-2026-116173 and CVE-2026-116174); they share a fixed version but are distinct validation gaps.
Who can reach it
Network, unauthenticated (PR:N) - anyone who can reach the vLLM Rust gRPC endpoint. AC:H in the vector reflects the need to hit a wrapping or oversized value that evades the limit check.
What to do
Upgrade to vLLM 0.24.0 or later and restart the serving processes - rolling restart of inference replicas, no node drain. Until then, do not expose the gRPC frontend beyond a trusted network and clamp or reject top_n at the proxy.
References
Related entries
- vLLM Rust gRPC frontend: >128 output_candidates.token_ids triggers a fatal sampler exceptionCVE-2026-116173 · vLLM Rust gRPC frontend (output_candidates.token_ids / logprob_token_ids limit)High
- vLLM Rust gRPC frontend: out-of-vocabulary prompt token ids kill EngineCore via embedding lookupCVE-2026-116174 · vLLM Rust gRPC Generate/GenerateStream (unchecked prompt.token_ids)High
- vLLM: inconsistent multimodal metadata on the disaggregated generate endpoint crashes the engineCVE-2026-116178 · vLLM disaggregated /inference/v1/generate (multimodal mm_placeholders / mm_hashes handling)High
- MLflow: unauthenticated SSRF in get-artifacts discloses information from the tracking serverCVE-2026-118628 · MLflow tracking server (get-artifacts URI validation)High
- GitLab AI Gateway: crafted model metadata redirects model requests and discloses Vertex or Bedrock credentialsCVE-2026-19889 · GitLab AI Gateway (Duo Agent Platform model metadata handling)High
- Docker Model Runner (vllm-metal backend): `trust_remote_code=True` set unconditionally, no sandboxCVE-2026-5817 · Docker Model Runner (vllm-metal backend)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.