1[medium] vllm: vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM enginegithub.comHigh10·23 20:43Z
A medium-severity vulnerability tracked as CVE-2026-114050 enables an unauthenticated attacker to crash an entire vLLM inference engine by exploiting unsynchronized multimodal processor caches1. The flaw stems from vLLM's use of a client-supplied UUID field as the multimodal cache identity without consistency validation, allowing an attacker to force a mismatch between placeholder tokens and cached tensor data that kills the EngineCore process. Versions below 0.31.0 are affected; the patch ships in vLLM 0.31.0.