CVE-2026-100647

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cachesalt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP...

PT-2026-99318

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.0 Description A denial-of-service issue exists in OpenAI-compatible and Anthropic API endpoints. The cache salt parameter lacks maximum length validation and is processed on the single EngineCore scheduler thread...