CVE-2026-100647

vLLM versions before 0.29.0 are vulnerable to a denial-of-service attack via the cache_salt parameter on OpenAI-compatible and Anthropic API endpoints. The root cause is a lack of maximum length validation , allowing unauthenticated attackers to send multi-hundred-megabyte salt values. Because th...