CVEFinder.io

CVE-2026-105756

đŸ”ļ medium
🔍 Scan for this CVE
Summary

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying ser

Description

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0.

CVSS Score
6.5
Medium
EPSS Score
0.3
Exploit Probability
Published Date
2026-10-05
First Seen: 2026-10-08
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 46.5% of all 365,616 vulnerabilities in our database.

#195,441
Below average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Oct 6, 2026
🔍 Exploitation Status
None
No known exploits
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-10-08
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE IDs (Weakness Types)
CWE-20 CWE-248

đŸ“Ļ Affected Products 1

Vendor Product Status Affected Versions
vllm vllm Affected
< 0.30.0

🔗 References 4

https://github.com/vllm-project/vllm/commit/e962733e...
Patch
https://github.com/vllm-project/vllm/pull/51444
Issue Tracking Patch
https://github.com/vllm-project/vllm/releases/tag/v0...
Release Notes
https://github.com/vllm-project/vllm/security/adviso...
Mitigation Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-105752 ℹī¸ low 3.1 0.2 vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted... 2026-10-05
CVE-2026-105753 đŸ”ļ medium 6.5 0.4 vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU ... 2026-10-05
CVE-2026-105754 đŸ”ļ medium 6.5 0.3 vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint ... 2026-10-05
CVE-2026-105755 đŸ”ļ medium 4.2 0.2 vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at th... 2026-10-05
CVE-2026-105757 đŸ”ļ medium 6.5 0.3 vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures c... 2026-10-05
CVE-2026-105758 đŸ”ļ medium 5.3 0.3 vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and... 2026-10-05
These CVEs affect the same products