vLLM CVE-2026-105754

Requires that vLLM be deployed in the disaggregated scale-out (token-in-token-out) serving mode and that the attacker can reach the /inference/v1/generate endpoint - this is a non-default deployment configuration, not a standard single-node serve. Per CVSS PR:L, low-privilege authenticated access to that endpoint is required. The denial-of-service variant needs only a forged multimodal features payload (mismatched parallel fields, non-positive placeholder length, or forged grid geometry) to terminate the shared EngineCore. The cache poisoning/retrieval variant has an additional precondition: the attacker must know or be able to induce the victim's content hash to forge matching cache identifiers, which limits it to targeted rather than opportunistic abuse. Multi-tenancy on the shared EngineCore is what makes the DoS and cross-request cache impacts meaningful.

This is a moderate-priority, access-gated availability risk with underappreciated confidentiality/integrity dimensions. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) scores only the denial-of-service: forged grid geometry, field types, or non-positive placeholder lengths reliably terminate the shared EngineCore, affecting all co-tenant requests. However, the description explicitly adds two impacts the official vector omits: forged cache hashes can poison or RETRIEVE cross-request encoder-cache state (a confidentiality AND integrity impact, consistent with the 'Information Disclosure' tag), and dropped sparse placeholder masks can alter replayed transport semantics. The C:N/I:N in the vendor vector therefore conflicts with the narrative - treat this as a DoS-plus-information-disclosure flaw, not pure DoS. Exploitation status: no public exploit identified at time of analysis - the only source-code evidence is the fixing patch (PR 51898), not POC code; there is no CISA KEV listing and no EPSS score was provided, so widespread opportunistic exploitation is unproven. The real-world attack surface is narrowed by two factors: it requires low-privilege authenticated access (PR:L) to an internal endpoint, and it only exists in the non-default disaggregated scale-out deployment path. The cache poison/retrieve primitive further requires the attacker to know or induce the victim's content hash, which is a meaningful complexity barrier. Net: credible priority for operators running vLLM disaggregated serving in multi-tenant settings, lower concern for single-tenant or non-disaggregated deployments.

A low-privilege tenant with access to the internal disaggregated-serving generate endpoint submits a request whose features.kwargs_data, mm_hashes, and mm_placeholders fields are crafted with mismatched lengths or a non-positive placeholder length, crashing the shared EngineCore and denying service to all co-located requests. A more targeted attacker who can learn or induce another tenant's content hash supplies forged cache identifiers to poison or read back that victim's encoder-cache state. No public exploit code is identified; only the fixing patch is available.