Database/AI/ML frameworks & serving
vLLM: unbounded cache_salt stalls the EngineCore scheduler thread, denying service to all requests
Impact
An unauthenticated caller can post a multi-hundred-megabyte cache_salt value on the OpenAI- or Anthropic-compatible endpoints. The value is pickled and SHA-256 hashed on the single EngineCore scheduler thread, so one request stalls scheduling for every other request on that server. On a GPU node this takes the whole model replica offline, not one session, and the GPUs sit idle while the scheduler churns CPU. No code execution or data disclosure.
Who can reach it
Anyone who can reach the inference HTTP endpoint. No authentication needed on this path, so any tenant or, where the endpoint is exposed beyond the cluster, any network caller.
What to do
Upgrade to vLLM 0.29.0 and restart each serving process; model weights reload, so expect a cold start per replica. Until then, cap request body size at the ingress or gateway in front of vLLM and keep the endpoint off untrusted networks.
References
Related entries
- vLLM: audio clip size limit not enforced, letting unauthenticated clients exhaust node memory and CPUCVE-2026-100648 · vLLM (multimodal chat audio decoding, VLLM_MAX_AUDIO_CLIP_FILESIZE_MB)Medium
- Quarkus LangChain4j: unauthenticated CONNECT frames leak chat scopes until the JVM exitsCVE-2026-108748 · Quarkus LangChain4j chat-scopes WebSocket endpoint (/_chat/routes)Medium
- Crawl4AI: robots.txt fetch bypasses egress controls, giving blind SSRF to metadata endpointsCVE-2026-109239 · Crawl4AI (RobotsParser.can_fetch in the Docker server)Medium
- llama.cpp: reachable assertion in the Mirostat sampler aborts the server remotelyCVE-2026-116467 · llama.cpp Mirostat sampler (src/llama-sampler.cpp)Medium
- llama.cpp: integer overflow in GGUF tensor shape validation leads to out-of-bounds memory accessCVE-2026-116829 · llama.cpp gguf_init_from_reader (tensor element-count validation)Medium
- llama.cpp: integer overflow in GGUF tensor size padding yields an undersized data blob and out-of-bounds readsCVE-2026-116840 · llama.cpp (gguf_init_from_reader tensor size padding)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.