CVE-2026-116180

vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors

Published Oct 25, 2026 CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Description

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests.

Analysis

Technical impact

A flaw in vLLM causes the LogprobsTensors.empty_cpu() function to allocate an uninitialized int32 tensor, and the V1 model runner leaves certain prompt positions unwritten. If a client sends a prompt_logprobs or echo request that relies on a connector‑cached prefix, the tokenizer decoding path can trigger an OverflowError. The error propagates to EngineCore, causing the whole engine process to crash and dropping all in‑flight requests from every tenant sharing the instance. The result is a denial of service that disables service for all tenants attached to the affected engine.

Affected Systems

vLLM, version 0.8.5 through 0.30.x (inclusive), any installation that uses the multi‑tenant server mode. The vulnerability is limited to those releases before the 0.31.0 fix.

Risk and Exploitability

The CVSS score of 8.3 indicates a high severity issue. EPSS is unavailable, and the vulnerability is not listed in CISA KEV. The likely attack vector requires an attacker who can submit inference requests to a shared vLLM engine; by crafting a prompt_logprobs or echo request against a cached prefix the attacker can trigger the OverflowError and crash the engine. The exploit therefore targets multi‑tenant deployments, with the risk being that a single malicious tenant can indiscriminately disrupt all co‑tenant workloads.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

vllm-project

vllm

unaffected

Version	Status	Constraints
`0.8.5`	affected	< 0.31.0
`0.31.0`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Vllm

Version	Status	Scheme	Platform
`[0.8.5,0.31.0)`	affected	semver	—
`0.31.0`	unaffected	semver	—

Vllm-project

Vllm

Version	Status	Scheme	Platform
`[0.8.5,0.31.0)`	affected	semver	—
`0.31.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the vLLM package to version 0.31.0 or newer, which contains the fix for the uninitialised LogprobsTensors bug.
If an immediate upgrade is not possible, isolate tenants by running separate vLLM engine instances per tenant so that a crash in one instance does not affect others.
Until the patch is applied, refrain from sending prompt_logprobs or echo requests that request logprobs in the client; if such functionality is required, validate the request handling to avoid triggering the overflow condition.

Generated by OpenCVE AI on October 25, 2026 at 16:37 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.254% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/vllm-project/vllm/security/advisories/GHSA-rhcx-5729-88vg
https://nvd.nist.gov/vuln/detail/CVE-2026-116180
https://www.cve.org/CVERecord?id=CVE-2026-116180
https://www.vulncheck.com/advisories/vllm-from-0.8.5-before-0.31.0-cross-tenant-dos-via-uninitialized-logprobstensors

History

Oct 26, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 12:30 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-116180 https://www.cve.org/CVERecord?id=CVE-2026-116180
Metrics	threat_severity `None`	threat_severity `Moderate`

Oct 25, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Vllm-project Vllm-project vllm
Vendors & Products		Vllm-project Vllm-project vllm

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests.
Title		vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors
First Time appeared		Vllm Vllm vllm
Weaknesses		CWE-908
CPEs		cpe:2.3:a:vllm:vllm::::::::
Vendors & Products		Vllm Vllm vllm
References		https://github.com/vllm-project/vllm/security/advisories/GHSA-rhcx-5729-88vg https://www.vulncheck.com/advisories/vllm-from-0.8.5-before-0.31.0-cross-tenant-dos-via-uninitialized-logprobstensors
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H'}` cvssV4_0 `{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H'}`