EUVD-2026-107001
GHSA-hfwf-hgvp-4rr8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed vLLM inference API
-
ExploitSend request with forged multimodal UUID
-
ExecutionDesync P0/P1 processor caches on cache hit
-
ImpactTrigger fatal token-placeholder mismatch, kill serving instance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | The target must be a vLLM instance (before 0.31.0) serving a multimodal model, since the flaw lives in how the multimodal processor caches (P0/P1) key entries on client-supplied UUIDs; a text-only deployment is not affected. Exploitation requires sending inference requests that reuse or forge a multimodal UUID so that a cache hit occurs against mismatched content, with no consistency check performed. Limiting factors: the deployment must expose the multimodal inference API to the attacker, and the authentication requirement is not confirmed from available data - the description states unauthenticated access while the CVSS vector indicates PR:L, so whether an API key or token is needed depends on how the operator configured the endpoint (vLLM's default server has no authentication). |
| Impact | This is a denial-of-service vulnerability (CWE-345, insufficient verification of data authenticity) in vLLM's handling of client-supplied multimodal UUIDs. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores 7.1 and reflects a network-reachable, low-complexity attack with high availability impact but zero confidentiality or integrity impact - consistent with a service-crash bug rather than code execution or data exposure. A key conflict exists in the source data: the description explicitly states 'Unauthenticated attackers,' yet the CVSS vector specifies PR:L (authenticated/low privilege) - verify with vendor, as this materially changes exposure (vLLM's OpenAI-compatible server commonly runs without authentication by default, which would support the unauthenticated reading and arguably warrants PR:N). No EPSS score, CISA KEV listing, or public POC was provided in the input; therefore there is no public exploit identified at time of analysis. Real-world priority is moderate: the impact ceiling is availability-only (a restartable crash, not RCE or data theft), so despite easy triggering this is a reliability/resilience risk rather than a critical breach vector. It matters most for production inference endpoints where a single forged request can take down the entire serving instance. |
| Exploit ScenarioDerived | An attacker with network access to a vLLM inference endpoint serving a multimodal model sends crafted requests that reuse or forge the client-supplied multimodal UUID, which vLLM trusts verbatim as a cache key without any consistency check. This desynchronizes the P0/P1 processor caches, producing a fatal token-placeholder mismatch that crashes the entire serving process and denies service to all clients until an operator restarts it. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Denial of service in vLLM before 0.31.0 allows remote attackers to crash the entire serving instance by forging or reusing a client-supplied multimodal UUID so the P0/P1 processor caches disagree on token placeholders and hit a fatal mismatch. The flaw is reachable only when the deployment serves a multimodal model and exposes the multimodal inference API; text-only vLLM deployments are not affected. No public exploit was identified at time of analysis, and authentication requirements are conflicting in the supplied data: the CVSS 4.0 vector is PR:L while the independent assessment uses PR:N and the description says unauthenticated, so exposure depends on whether the endpoint is protected (vLLM's default server has no authentication per the assessment).
RemediationAI
Vendor-released patch: vLLM 0.31.0 or later, which is the fix version identified by the 'before 0.31.0' affected range; see https://github.com/vllm-project/vllm/security/advisories/GHSA-p92p-rxj5-7p2x. If immediate upgrade is not possible, remove the attack surface by running text-only models or disabling multimodal inference endpoints when multimodal serving is not required, accepting loss of multimodal functionality. Otherwise, place the inference API behind an authenticating reverse proxy and restrict it to trusted clients, noting that this reduces exposure but does not fix cache desynchronization for clients that are allowed to submit multimodal requests; vLLM's default server has no authentication per the assessment. Add health checks and automatic restart or per-tenant instance isolation to limit outage duration and blast radius, but treat these as containment rather than remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vLLM is an LLM serving engine that uses processor caches (P0/P1) to speed up multimodal request handling. In affected versions, the server takes a client-supplied multimodal UUID verbatim as the cache identity and performs no consistency check when a cache hit occurs, which is CWE-345 insufficient verification of data authenticity. An attacker who can submit inference requests can desynchronize the P0/P1 caches by causing a hit against mismatched content, leading to a fatal token-placeholder mismatch and termination of the serving process. The CPE cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:* confirms the affected product is vLLM prior to 0.31.0. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N rates only availability impact as High; the independent CVSS 3.1 assessment agrees on availability-only impact but uses PR:N, so the effective authentication prerequisite is deployment-dependent.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable, low-complexity forged request with no user interaction; PR:N follows the description's 'unauthenticated' claim and vLLM's default no-auth server, though vendor used PR:L; impact is availability-only (A:H), no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.
Technical POC Analysis
CWE-345 (Insufficient Verification of Data Authenticity), specifically a client-controlled cache key with an unvalidated cache-hit path.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
vLLM deployments that expose multimodal inference APIs face a high-severity availability risk: a crafted request can crash the entire model-serving instance, disrupting every application and user that depends on that endpoint. Text-only vLLM services are not affected, but production or customer-facing multimodal inference should be prioritized because no vendor patch was available at analysis time and endpoint protection may vary. No public exploit identified at time of analysis, so near-term risk is driven mainly by exposed API surface and the absence of a patch.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling or restricting the multimodal inference API, requiring authentication and network allowlisting at a gateway, validating and rejecting forged or replayed multimodal UUIDs, rate-limiting and monitoring crash patterns, and isolating multimodal serving until upgrade to vLLM 0.31.0 or later is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in vLLM Cache and Resource Consumption Vulnerabilities
View all 7vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Vllm versions up to 0.12.0 is affected by allocation of resources without limits or throttling (CVSS 6.5).
Exploit-DB