VLLM: Forged Multimodal UUID + P0/P1 Processor-cache Eviction Drift: Unauthenticated Remote Crash Of The Whole VLLM Engi

Summary Multimodal content parts "imageurl", "videourl", "inputaudio", ... accept a user-supplied "uuid" field that vLLM uses verbatim as the item's cache identity "mmhash". The two frontend/engine processor caches P0 "sender" cache in the API process, P1 "receiver" cache in the EngineCore proces...

vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

Summary Multimodal content parts imageurl, videourl, inputaudio, ... accept a user-supplied uuid field that vLLM uses verbatim as the item's cache identity mmhash. The two frontend/engine processor caches P0 "sender" cache in the API process, P1 "receiver" cache in the EngineCore process are...

GHSA-P92P-RXJ5-7P2X vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

Summary Multimodal content parts imageurl, videourl, inputaudio, ... accept a user-supplied uuid field that vLLM uses verbatim as the item's cache identity mmhash. The two frontend/engine processor caches P0 "sender" cache in the API process, P1 "receiver" cache in the EngineCore process are...

EUVD-2026-107001

vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine...

GHSA-HFWF-HGVP-4RR8 Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p92p-rxj5-7p2x. This link is maintained to preserve external references. Original Description vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cac...

Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p92p-rxj5-7p2x. This link is maintained to preserve external references. Original Description vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cac...

CVE-2026-114050

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving...

CVE-2026-114050 vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving...

CVE-2026-114050 vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving...

CVE-2026-114050

Versions of vLLM before 0.31.0 are vulnerable to a remote engine crash due to insufficient verification of data authenticity (CWE-345 ). The software uses a client-supplied multimodal uuid as a cache identity without performing any consistency checks on cache hits. This allows unauthenticated att...

CVE-2026-114050

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving...

CVE-2026-114050 vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving...

PT-2026-120176

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.31.0 Description The software uses a client-supplied multimodal uuid verbatim as a cache identity without performing consistency checks on cache hits. This allows unauthenticated attackers to desynchronize the P0/P1...