CVE-2026-114050

vLLM can crash when two multimodal caches disagree on a client-supplied ID

vLLM · V1 multimodal processor and receiver caches

First documented disclosure · Review checkpoint

Summary

Reusing a media ID can cause a shared engine to process incompatible tensors and stop.

Severity and exploitation evidence

High · 7.1/10 · CVSS 4.0. Severity source.

Exploitation not established: A benchmark failure and a controlled attack path are documented. An adversary targeting a live tenant is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The frontend and engine evict cached media independently. A receiver cache hit can override newly supplied media, leading to a mismatch between placeholders and actual embeddings.

Conditions required

A client can submit multimodal requests and reuse its own media ID across requests. Access depends on the deployment’s inference authentication.

Potential impact

The shared engine can fail and drop other work until restart. A benchmark operator documented a matching failure without malicious traffic.

Affected versions and configurations

Versions before 0.31.0 per VulnCheck and vLLM.

Fix and mitigation status

0.31.0 per vLLM. The fix gives resent media precedence over a stale receiver-cache entry.

Practical next steps

Upgrade affected multimodal servers, isolate inference tenants where practical and monitor engine exits following media validation errors.

Operating lesson

Independent caches must verify that reused identifiers describe the same content at both ends.

Evidence and limits

The September 6 public issue describes the stale-cache crash during benchmarking. The September 20 fix describes the fresh-payload collision. The later GHSA explains how to deliberately desynchronize caches. CNA CVSS 4.0 uses a low-privilege vector while the advisory notes unprotected endpoints can be reached without credentials.

Sources