vLLM Cache Desynchronization Leading to Engine Crash

Executive Summary

CVE-2026-114050 is a vulnerability in vLLM versions before 0.31.0 where a client-supplied multimodal UUID is used directly as a cache identity without consistency checks. Unauthenticated attackers can exploit this to desynchronize processor caches (P0 and P1), causing a fatal token-placeholder mismatch that crashes the entire serving instance.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unusual cache eviction patterns and engine crashes in vLLM instances running versions before 0.31.0. Check logs for repeated crashes with error messages related to token-placeholder mismatches or cache inconsistencies. Monitor network traffic for repeated requests with unique UUIDs and large payloads from the same source.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated remote attackers to crash the vLLM serving instance, leading to denial-of-service conditions. The attack requires no special privileges and can be executed in under a minute with default settings, forcing manual restarts of the service.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts availability by causing remote engine crashes, leading to denial-of-service conditions. For GDPR, it may affect the right to uninterrupted service under Article 32 (security of processing). For HIPAA, it could disrupt access to protected health information systems, potentially violating the Security Rule's availability requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade vLLM to version 0.31.0 or later immediately. If upgrading is not possible, implement network-level mitigations such as rate limiting requests with large payloads, blocking suspicious UUID patterns, or deploying a WAF to filter malformed requests. Disable multimodal features if unused.

Useful 0 Not Useful 0