CVE-2026-115912

vLLM shared-memory handle forgery reaches Python deserialization

vLLM project · vLLM scale-out multimodal cache

First documented disclosure · Review checkpoint

Summary

An authenticated inference caller could forge cache handles that cause a worker to deserialize attacker-selected bytes.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Shared-memory address and generation identifiers were accepted without binding them to a server-issued capability.

Conditions required

A scale-out deployment with shared-memory multimodal caching enabled and access to the affected inference routes.

Potential impact

Arbitrary Python execution in the worker process and disruption of engine availability.

Affected versions and configurations

Before 0.32.0 per the CNA; the advisory confirms 0.25.1 and describes versions through 0.25.1.

Fix and mitigation status

0.32.0.

Practical next steps

Upgrade and restrict scale-out interfaces; do not rely on disabling optional insecure serialization to close this separate path.

Operating lesson

Opaque cache identifiers are not authorization; authenticate them before dereferencing shared memory.

Evidence and limits

The public fix discussion on 2026-09-30 predates the October 20 advisory and October 26 CVE publication. A controlled marker-command test succeeded with insecure serialization disabled; default LRU caching is not affected. CNA/advisory metadata give 7.5 CVSS 3.1, while advisory prose retains 8.8; this record uses the CNA score.

Sources