vLLM: forged multimodal uuid desynchronizes the processor cache and kills the serving instance

Impact

vLLM trusts a client-supplied multimodal uuid as the cache identity and performs no consistency check on a hit, so a caller can make the P0 and P1 processor caches disagree about what a cached entry contains. The resulting token-placeholder mismatch is fatal: the whole serving process dies and stays down until something restarts it, taking every in-flight request and the model weights resident on the GPUs with it. On a GPU node this is expensive downtime rather than a simple crash - reloading a large model into HBM is minutes of unavailable accelerators, and a repeat request kills it again as soon as it is back. Any multimodal vLLM endpoint reachable by untrusted callers is a one-request denial of service against that node's GPUs.

Who can reach it

Anyone who can send an inference request to the vLLM OpenAI-compatible endpoint. The advisory describes the attacker as unauthenticated; the CVSS vector records PR:L, so treat it as reachable by any tenant or caller permitted to submit multimodal requests.

What to do

Upgrade to vLLM 0.31.0 or later and restart each serving replica; the model reload is the real cost, so stage it per replica behind the load balancer rather than all at once. Until patched, do not expose multimodal endpoints to untrusted callers, and make sure a supervisor restarts the engine automatically so a crash is minutes rather than hours.

References

Related entries

• vLLM: one request with oversized min_tokens kills the EngineCore input thread while /health stays 200CVE-2026-114051 · vLLM (/inference/v1/generate min_tokens validation, EngineCore input thread)High
• vLLM: caller-controlled EXIF ImageID and cache_salt collide cache keys across requestsCVE-2026-114054 · vLLM (multimodal media cache and prefix KV cache key derivation)High
• Flexible GraphRAG: Cypher injection through ingested document content on the FalkorDB backendCVE-2026-114510 · Flexible GraphRAG FalkorDBAdapter (_escape / add_graph_documents Cypher assembly)High
• vLLM: audio decompression bomb via input_audio or audio_url exhausts serving node memoryCVE-2026-116175 · vLLM (AudioMediaIO load_audio, missing max_duration_s limit)High
• vLLM: out-of-vocabulary stop_token_ids crash the engine and write past the V2 runner logits bufferCVE-2026-116181 · vLLM (OpenAI-compatible API, stop_token_ids validation)High
• NVIDIA TensorRT-LLM: server-side request forgery lets a local user make the serving process issue arbitrary requestsCVE-2026-24269 · NVIDIA TensorRT-LLM (server-side request forgery in the serving component)High