vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM 0.32.0. Summary When --mm-processor-cache-type shm is enabled, vLLM's multimodal SHM cache represents a cached item with an address and monotonicid pair and treats that pair as authority to dereference shared memory in the worke...

GHSA-6757-HGGM-HP2W vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM 0.32.0. Summary When --mm-processor-cache-type shm is enabled, vLLM's multimodal SHM cache represents a cached item with an address and monotonicid pair and treats that pair as authority to dereference shared memory in the worke...

WS-2026-0140

vllm 0.20.0 - 0.31.0: the public /inference/v1/generate route accepts caller-forged multimodal SHM cache handles address, monotonicid that the worker dereferences without authentication, reaching pickle.loads on attacker-staged bytes when the SHM multimodal processor cache is enabled...