vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

Summary Multimodal content parts imageurl, videourl, inputaudio, ... accept a user-supplied uuid field that vLLM uses verbatim as the item's cache identity mmhash. The two frontend/engine processor caches P0 "sender" cache in the API process, P1 "receiver" cache in the EngineCore process are...

GHSA-P92P-RXJ5-7P2X vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

Summary Multimodal content parts imageurl, videourl, inputaudio, ... accept a user-supplied uuid field that vLLM uses verbatim as the item's cache identity mmhash. The two frontend/engine processor caches P0 "sender" cache in the API process, P1 "receiver" cache in the EngineCore process are...