vLLM
CVE-2026-105756
MEDIUM
GHSA-2823-qmq8-rwvj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege API access to vLLM endpoint
-
ExploitSend request with malformed cache_salt (forbidden char or >128 chars)
-
ExecutionTrigger uncaught ValueError in scheduler cache lookup
-
ImpactCrash EngineCore and deny service to all users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the deployment to be configured with the LMCache-MP connector (which uses the IPCCacheServerKey consumer) - default vLLM deployments without this connector are not vulnerable. The attacker must be able to submit an OpenAI-compatible request (CompletionRequest, ChatCompletionRequest, ResponsesRequest, or GenerateRequest) carrying a non-empty cache_salt, and the vector's PR:L indicates at least low-privilege API access is needed. The trigger is specific: a cache_salt containing a forbidden character ('@', '/', '\', or NUL) or exceeding 128 characters. Limiting factors: non-default connector configuration, required API-level privilege, and affected versions prior to 0.30.0. |
| Impact | This is a genuine but moderate-priority availability issue, not a high-severity emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly captures a network-reachable, low-complexity denial of service with no confidentiality or integrity impact, scoring 6.5 (Medium). The key dampening factor is scope of exploitability: the description states the crash only occurs 'on deployments using the LMCache-MP connector,' so the vast majority of default vLLM deployments are NOT affected, materially lowering real-world risk below what the network attack vector alone would suggest. PR:L indicates the attacker needs at least low-privilege API access, meaning it is not a fully unauthenticated flaw per the provided vector. No EPSS score was supplied, so quantitative exploitation probability cannot be stated. This is NOT in CISA KEV and no public exploit code was provided - the GitHub source evidence is the vendor fix (PR #51444), not weaponized exploit tooling. CONFLICT TO NOTE: the input Tags label this 'Information Disclosure,' which directly contradicts the CVSS vector (C:N/I:N/A:H) and the description - this is purely a denial-of-service / crash bug with zero disclosure impact; the tag appears mislabeled. |
| Exploit ScenarioDerived | On a vLLM instance configured with the LMCache-MP connector, an attacker with API access submits an OpenAI-compatible completion/chat/responses request containing a cache_salt value with a forbidden character (e.g. '/') or longer than 128 characters. Because the request model accepts the value without enforcing the IPCCacheServerKey restrictions, an uncaught ValueError is raised during scheduler cache lookup, crashing the EngineCore process and taking the service offline for all concurrent users. No public exploit code was identified in the provided data, but the condition is trivial to trigger once the vulnerable connector is in use. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Malformed cache_salt values submitted to vLLM's OpenAI-compatible inference endpoints can crash the EngineCore process and deny service to every concurrent user on deployments configured with the LMCache-MP connector. Only vLLM releases prior to 0.30.0 are affected, and exploitation requires low-privilege API access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base score 6.5) plus the non-default LMCache-MP connector; a cache_salt containing '@', '/', '\\', or NUL, or longer than 128 characters, raises an uncaught ValueError during scheduler cache lookup. The flaw is fixed in version 0.30.0, and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a genuine but moderate-priority availability issue rather than a high-severity emergency.
RemediationAI
Upgrade to vLLM 0.30.0 or later, which is the vendor-released patch and the version in which validate_cache_salt() is enforced across all OpenAI-compatible and scale-out request models; the release is available at github.com/vllm-project/vllm/releases/tag/v0.30.0 and the change is described in advisory GHSA-2823-qmq8-rwvj, with the underlying fix in PR 51444 / commit e962733e08d10f7ca65dac4df99e116460b8b174. If an immediate upgrade is not possible, the most effective compensating control is to disable or remove the LMCache-MP connector from the deployment configuration - the vulnerability is entirely unreachable without it, but the trade-off is loss of the multi-process prefix/KV caching that connector provides, which will reduce cache hit rates and increase latency and GPU memory pressure under high concurrency. As a secondary control, terminate cache_salt at an API gateway or reverse proxy that rejects any value longer than 128 characters or containing '@', '/', backslash, or NUL, or that strips the field outright; blocking the entire parameter prevents downstream cache-salting entirely, which can weaken cache-key isolation if multiple tenants share a cache, whereas length-and-character filtering preserves legitimate salts but requires the proxy to parse JSON bodies reliably. Because exploitation requires authenticated API access (PR:L), reducing the set of principals permitted to submit inference requests, or fronting the endpoint with authentication and per-user rate limits, raises the cost of the attack but does not remove the bug. Note that Environment: no public exploit code was identified at time of analysis, so urgency is driven by internal exposure of the LMCache-MP connector rather than by observed attack activity.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-20 improper input validation in vLLM's request-handling layer. vLLM exposes OpenAI-compatible request models - CompletionRequest, ChatCompletionRequest, ResponsesRequest, and the scale-out GenerateRequest - that accept an optional user-supplied cache_salt used as a per-request salt for KV-cache reuse. Prior to the fix, these Pydantic models accepted any non-empty string for cache_salt without checking it against the character and length constraints enforced downstream by the IPCCacheServerKey consumer in LMCache-MP, the multi-process LMCache connector. When a salt contains a forbidden character ('@', '/', backslash, or NUL) or exceeds the 128-character limit, the downstream consumer raises a ValueError that is not caught during scheduler cache lookup, propagating out of EngineCore and terminating the engine process - an unhandled exception in the core event loop rather than a graceful per-request error. The upstream fix adds a validate_cache_salt() helper in vllm/entrypoints/generate/base/protocol.py, defining _CACHE_SALT_FORBIDDEN_CHARS = frozenset('@/\\\x00') and _MAX_CACHE_SALT_LENGTH = 128, and wires it into each request model via a Pydantic @model_validator(mode='before') hook so invalid salts are rejected with a VLLMValidationError before they ever reach the cache backend; the same validation is applied to the pooling base protocol. The accompanying tests parametrize all four request models to confirm that '/' and 129-character salts are rejected and that a safe salt such as 'safe-cache_salt-123' is accepted. Two important scoping facts follow from this design: the vulnerable code path only exists when the LMCache-MP connector is in use, since default vLLM deployments never route cache_salt to IPCCacheServerKey, and the attacker needs the ability to submit an authenticated API request (PR:L) rather than merely reach the port.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable API request (AV:N) needing low-privilege access (PR:L) crashes the shared EngineCore for all users with no data impact, so A:H only; AC:L since the malformed salt is trivial to craft.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0.
Blast Radius
ecosystem impact- 4 pypi packages depend on vllm (4 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.30.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)CVE.org
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB