VulnSocial

CVE-2026-116172

LOWCVSS 8.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via CandidateTokens.top_n. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping top_n values to trigger torch.topk failures that terminate EngineCore.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-20

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-26: 110-26
Referenced assets2 URLs
Full discourse1 post
  • coworker security@coworker_sec

    [News] 弊社の脆弱性診断ツール「Red Agent」(ソースコード診断・Web 診断・ペンテストを AI エージェントで一気通貫に行うツール)で、vLLM の脆弱性10件(CVE-2026-116172〜116181)と、PHP の PHP2Shell(CVE-2026-109618 / 109619)の影響を受ける版を検出できるようにしました。 https://www.coworker.co.jp/red-agent https://x.com/coworker_sec/status/2114397807457296868

    0000027
    12 followersView on X

Explore more

Back to dashboard