제출 #801297: vllm-project vLLM 0.19.0 Use of Uninitialized Resource정보

제목vllm-project vLLM 0.19.0 Use of Uninitialized Resource
설명vLLM's block allocator returns GPU KV cache blocks to the free pool upon request completion or cancellation without zeroing their contents. When a subsequent request is allocated one of these dirty blocks, it decodes from stale activation data belonging to a previous request rather than from its own context. In a multi-tenant deployment, this means one user's conversationdata can influence, or appear verbatim in, another user's response. The bug is confirmed reproducible on vLLM 0.19.0 with 10/10 run consistency across multiple independent traces. It does not require speculative decoding, prefix caching, or any special server configuration, only concurrent requests under normal load. Affected requests produce completely different output sequences across runs at temperature=0, where outputs should be fully deterministic.
원천⚠️ https://github.com/vllm-project/vllm/issues/39146
사용자
 Zyz3366 (UID 97230)
제출2026. 04. 09. PM 09:44 (5 개월 ago)
모더레이션2026. 04. 26. PM 09:38 (17 days later)
상태수락
VulDB 항목359740 [vLLM 까지 0.19.0 KV Block kv_cache_interface.py has_mamba_layers 원격 코드 실행]
포인트들20

Interested in the pricing of exploits?

See the underground prices here!