VLLM: Seven Vulnerabilities Disclosed, Affecting Resource Management and Caching
Seven vulnerabilities in VLLM, disclosed on October 21, 2026, expose risks of resource exhaustion, cache manipulation, and denial-of-service, affecting versions before 0.31.0.
Key findings
- Seven vulnerabilities disclosed in VLLM, impacting versions prior to 0.31.0.
- High-severity flaws include uncontrolled resource consumption and memory exhaustion.
- Cache manipulation vulnerabilities allow for data collision and denial-of-service.
- Improper request processing can lead to service disruption and unresponsiveness.
- All issues are resolved in VLLM version 0.31.0.
On October 21, 2026, a batch of seven vulnerabilities was disclosed in the VLLM library, impacting versions prior to 0.31.0. These vulnerabilities, ranging in severity from Low to High, primarily concern resource consumption, cache manipulation, and denial-of-service conditions, potentially allowing unauthenticated remote attackers to disrupt VLLM services.
Several vulnerabilities stem from improper handling of multimodal processor parameters and caching mechanisms. CVE-2026-114055 and CVE-2026-114052 highlight uncontrolled resource consumption and memory exhaustion, respectively. In CVE-2026-114055, attackers can control multimodal processor parameters per request, leading to excessive resource usage. CVE-2026-114052 specifically targets MOSS-Audio model serving, where caching processors for distinct request parameters can lead to unbounded memory growth.
Cache aliasing and manipulation are also key themes. CVE-2026-114054 describes a cache aliasing vulnerability where authenticated attackers can collide shared cache keys using caller-controlled values like EXIF ImageID or cache_salt, potentially retrieving cached data from other requests. Similarly, CVE-2026-114050 allows unauthenticated attackers to desynchronize processor caches by using client-supplied UUIDs verbatim, leading to engine crashes due to token-placeholder mismatches.
Further issues relate to request processing and validation. CVE-2026-114053 allows clients to select specific revisions of a model's dynamic processor code when trust_remote_code is enabled, posing a risk if a malicious revision is served. CVE-2026-114051 details a bypass of the min_tokens <= max_tokens check for certain generation requests, which can cause the input thread to die, rendering the /health endpoint unresponsive while the service is effectively hung.
Finally, CVE-2026-114049, a low-severity vulnerability, involves a cross-request mask leak in InputBatch.condense(). This allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows, particularly exploitable via concurrent constrained generate requests.
All disclosed vulnerabilities are addressed in VLLM version 0.31.0. Users are strongly advised to update to this version to mitigate the risks associated with these security flaws. The coordinated disclosure of these seven issues underscores the importance of timely patching for VLLM deployments to maintain service stability and security.
The vulnerabilities were disclosed on October 21, 2026. The affected versions are prior to 0.31.0. The patched version is 0.31.0.
CVEs discussed in this report: CVE-2026-114055, CVE-2026-114054, CVE-2026-114053, CVE-2026-114052, CVE-2026-114051, CVE-2026-114050, CVE-2026-114049.