vllm-project vLLM up to 0.29.x EngineCore /inference/v1/generate input validation

Summaryinfo

A vulnerability marked as problematic has been reported in vllm-project vLLM up to 0.29.x. This impacts an unknown function of the file /inference/v1/generate of the component EngineCore. This manipulation of the argument features.kwargs_data/features.mm_hashes/features.mm_placeholders causes input validation. This vulnerability is handled as CVE-2026-105754. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in vllm-project vLLM up to 0.29.x and classified as problematic. Affected by this vulnerability is an unknown code of the file /inference/v1/generate of the component EngineCore. The manipulation of the argument features.kwargs_data/features.mm_hashes/features.mm_placeholders with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect availability. The summary by CVE is:

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm_hashes field, ranges in the features.mm_placeholders field, and wire-selected multimodal field processors without rebinding them to the active model renderer contract. Forged grid geometry, field types, or non-positive placeholder lengths can terminate the shared EngineCore; when an attacker knows or can induce a victim's content hash, forged cache hashes can poison or retrieve cross-request encoder-cache state; and dropped sparse placeholder masks can alter replayed transport semantics. This issue is fixed in version 0.30.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-105754 since 10/05/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation needs additional levels of successful authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.30.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• vllm-project

Name

• vLLM

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29

Website

• Product: https://github.com/vllm-project/vllm/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion