Is CVE-2026-116181 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116181?

CVE-2026-116181 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-116181

Description

vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or write outside the V2 runner's logits buffer.