vLLM Rust gRPC frontend: >128 output_candidates.token_ids triggers a fatal sampler exception

Impact

The Rust gRPC frontend does not enforce the logprob_token_ids limit, so a Generate or GenerateStream request with output_logprobs enabled and more than 128 output_candidates.token_ids raises a fatal exception in the sampler and terminates EngineCore. The replica stops serving and all co-tenant requests in flight are lost; recovery requires the process to restart and reload weights onto the GPUs. This is one of three distinct unvalidated-field crashes in the same gRPC frontend (CVE-2026-116172, CVE-2026-116174) fixed in the same release.

Who can reach it

Network, unauthenticated - any client able to reach the vLLM Rust gRPC Generate or GenerateStream service.

What to do

Upgrade to vLLM 0.24.0 or later and restart the serving processes - rolling restart of inference replicas, no node drain. Interim: keep the gRPC frontend off untrusted networks and cap the number of candidate token ids at the proxy.

References

Related entries

• vLLM Rust gRPC frontend: out-of-vocabulary prompt token ids kill EngineCore via embedding lookupCVE-2026-116174 · vLLM Rust gRPC Generate/GenerateStream (unchecked prompt.token_ids)High
• vLLM: inconsistent multimodal metadata on the disaggregated generate endpoint crashes the engineCVE-2026-116178 · vLLM disaggregated /inference/v1/generate (multimodal mm_placeholders / mm_hashes handling)High
• MLflow: unauthenticated SSRF in get-artifacts discloses information from the tracking serverCVE-2026-118628 · MLflow tracking server (get-artifacts URI validation)High
• GitLab AI Gateway: crafted model metadata redirects model requests and discloses Vertex or Bedrock credentialsCVE-2026-19889 · GitLab AI Gateway (Duo Agent Platform model metadata handling)High
• Docker Model Runner (vllm-metal backend): `trust_remote_code=True` set unconditionally, no sandboxCVE-2026-5817 · Docker Model Runner (vllm-metal backend)High
• praktor: unsanitized Telegram upload filename writes outside uploads/ into the persistent agent workspaceCVE-2026-62331 · praktor multi-agent Claude Code orchestrator (Telegram document upload)High