CVE-2026-114050 in vLLM
Summary
by MITRE • 10/22/2026
vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability in vLLM versions prior to 0.31.0 stems from an insecure handling of multimodal identifiers within its caching mechanism. Specifically, the system accepts client-supplied universal unique identifiers (UUIDs) and uses them verbatim as cache keys without performing any consistency checks or validation against expected data structures during cache hit operations. This design flaw allows unauthenticated attackers to inject malformed or mismatched UUID values that do not correspond to valid cached multimodal content. When such a request is processed, the system attempts to retrieve non-existent or incorrectly formatted data from the cache, leading to internal state desynchronization between different processing stages of the inference engine.
The technical consequence of this flaw is severe and immediate. The mismatch in expected versus actual token placeholders causes a fatal error within the serving instance. Because vLLM relies on tightly coupled processor caches for efficient tensor operations, an inconsistency at the cache level propagates rapidly through the execution pipeline. This results in a denial of service condition where the entire model serving process crashes and becomes unresponsive until it is manually restarted by an administrator or automated recovery system. The attack does not require authentication, making it particularly dangerous in public-facing deployments where any user can submit inference requests with crafted payloads designed to trigger this cache desynchronization.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write if the memory corruption leads to buffer overruns during the mismatch handling process. In terms of attack vectors, it maps to MITRE ATT&CK technique T1499 Endpoint Denial of Service, as the primary impact is the disruption of service availability rather than data exfiltration or privilege escalation. The lack of input sanitization on critical system identifiers represents a fundamental failure in defensive coding practices for high-throughput inference engines that rely heavily on stateful caching optimizations.
To mitigate this risk, organizations running vLLM must upgrade to version 0.31.0 or later where the cache identity verification logic has been hardened. Until an upgrade is feasible, operators should implement network-level controls such as rate limiting and request filtering at the reverse proxy or API gateway layer to restrict access from untrusted sources. Additionally, deploying a Web Application Firewall with rules capable of detecting anomalous UUID formats in multimodal requests can provide a temporary buffer against exploitation. It is also advisable to configure automatic restart policies for critical inference services to minimize downtime, although this does not address the root cause and leaves the system vulnerable to repeated disruption attacks.