CVE-2026-114050 — vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID
vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers …
Published: 2026-10-21 · CVSS: 7.1 · CVSS 4.0
vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7