Database/AI/ML frameworks & serving
vLLM Rust gRPC frontend: out-of-vocabulary prompt token ids kill EngineCore via embedding lookup
Impact
The Rust gRPC Generate and GenerateStream service forwards client-supplied prompt.token_ids to EngineCore without range checking them against the model vocabulary. An out-of-vocabulary id causes a fatal embedding lookup failure that terminates EngineCore and leaves the server reporting unhealthy, so the replica stays down until it is restarted and the model is reloaded into GPU memory. Any tenant sharing the endpoint loses its in-flight work. This is the third of three distinct input-validation crashes in the same gRPC frontend (CVE-2026-116172, CVE-2026-116173) fixed in the same release.
Who can reach it
Network, unauthenticated - any client that can submit a Generate or GenerateStream request with raw prompt token ids.
What to do
Upgrade to vLLM 0.24.0 or later and restart the serving processes - rolling restart of inference replicas, no node drain. Until then, reject raw prompt.token_ids or validate them against the vocabulary size at the gateway, and keep the gRPC listener on a trusted network.
References
Related entries
- vLLM: inconsistent multimodal metadata on the disaggregated generate endpoint crashes the engineCVE-2026-116178 · vLLM disaggregated /inference/v1/generate (multimodal mm_placeholders / mm_hashes handling)High
- MLflow: unauthenticated SSRF in get-artifacts discloses information from the tracking serverCVE-2026-118628 · MLflow tracking server (get-artifacts URI validation)High
- GitLab AI Gateway: crafted model metadata redirects model requests and discloses Vertex or Bedrock credentialsCVE-2026-19889 · GitLab AI Gateway (Duo Agent Platform model metadata handling)High
- Docker Model Runner (vllm-metal backend): `trust_remote_code=True` set unconditionally, no sandboxCVE-2026-5817 · Docker Model Runner (vllm-metal backend)High
- praktor: unsanitized Telegram upload filename writes outside uploads/ into the persistent agent workspaceCVE-2026-62331 · praktor multi-agent Claude Code orchestrator (Telegram document upload)High
- GitLab AI Gateway: crafted inline flow config overrides the HTTP Host header and leaks Vertex credentialsCVE-2026-75871 · GitLab AI Gateway (Duo Agent Platform inline flow configuration)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.