| Título | vLLM Project vLLM v0.30.0, v0.31.0 Improper Resource Management |
|---|
| Descrição | A request-dependent KV-cache accounting flaw in vLLM can cause one request to be decoded using another request’s prompt prefix. The issue occurs when cascade attention and SimpleCPUOffloadConnector are enabled with the V1 model runner. It was reproduced on vLLM v0.30.0 using the FLASH_ATTN backend.
The common-prefix detection logic determines whether a GPU KV-cache block is shared by all requests by comparing the block’s reference count with the number of tracked requests. However, SimpleCPUOffloadConnector temporarily increments block reference counts while CPU offload operations are pending. These additional references do not represent request ownership. Consequently, a block shared by only a subset of requests can be incorrectly classified as common to the entire batch. Cascade attention then uses the first request’s KV-cache prefix for other requests whose prompts do not contain that prefix.
The reported reproduction submits 15 requests sharing a 2,048-token prefix alongside one unrelated 400-token request. During an offload operation, 15 request references plus one offload reference incorrectly satisfy the common-prefix test for 16 requests. The unrelated request is subsequently decoded against the shared prefix belonging to the other requests. Its response includes content from that prefix and is returned normally without an error. One reported run reproduced output contamination in 11 of 12 trials. Control runs without cascade attention or without the connector did not reproduce this contamination in the unrelated request.
In a deployment serving mutually untrusted callers through the affected configuration, an attacker able to submit concurrent requests could potentially influence another caller’s generated output by arranging shared-prefix requests and suitable timing. The demonstrated impact is cross-request output contamination. Disclosure of confidential prompt content is a potential consequence, but extraction of a victim’s secret by an attacker has not been demonstrated.
Exploitation depends on the affected server configuration, batch composition, and overlap with pending offload operations. The reproduction uses the same cache_salt for all requests; behavior across distinct cache salts has not been established. The reported cascade eligibility conditions include at least eight requests and at least 256 computed tokens per request. vLLM’s current documentation states that a shared server process does not provide tenant isolation.
The report identifies the same common-prefix accounting logic in v0.31.0. It also states that cascade attention was removed from the main branch by pull request #61126. Disabling cascade attention prevented the reported reproduction. Maintainer confirmation, the complete affected version range, and a released fix remain unconfirmed. |
|---|
| Fonte | ⚠️ https://github.com/vllm-project/vllm/issues/61673 |
|---|
| Utilizador | Zyz3366 (UID 97230) |
|---|
| Submissão | 19/10/2026 20h24 (há 26 dias) |
|---|
| Moderação | 14/11/2026 07h42 (26 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 437419 [vllm-project vllm 0.30.0/0.31.0 Common Prefix single_type_kv_cache_manager.py Condição de Corrida] |
|---|
| Pontos | 20 |
|---|