CVE-2026-105756 · GHSA-2823-qmq8-rwvj
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
- Risk score
- 49/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a sal…
- Affected
- vllm (pip) < 0.30.0
- Fix
- Upgrade vllm to 0.30.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
Vllm: Amber, patch this week. vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids to trigger CUDA ten…
The flaws
- CVE-2026-105756: VLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service (CVSS 6.5 · EPSS 0%)
- CVE-2026-100652: Improper input validation (CVSS 7.5 · EPSS 0%)
- CVE-2026-105759: VLLM is an inference and serving engine for large language models (CVSS 7.5 · EPSS 0%)
- CVE-2026-103241: Denial of service (CVSS 7.5 · EPSS 1%)
The fix
Upgrade Vllm: 0.30.0 or later on your release line
Who is exposed: Vllm
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-248 (CWE-248). 63 other warnings in 30 days
- Same product: Earlier vllm warnings. 15 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| vllm | pip | < 0.30.0 | 0.30.0 |
References
- https://github.com/advisories/GHSA-2823-qmq8-rwvj
- https://github.com/vllm-project/vllm/security/advisories/GHSA-2823-qmq8-rwvj
- https://github.com/vllm-project/vllm/pull/51444
- https://github.com/vllm-project/vllm/commit/e962733e08d10f7ca65dac4df99e116460b8b174
- https://github.com/vllm-project/vllm/releases/tag/v0.30.0
- https://github.com/advisories/GHSA-2823-qmq8-rwvj
Original description
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0.
Last activity 5 Oct 2026. Patch Forecast updates every hour.