GHSA-hfwf-hgvp-4rr8

Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization

Published

2026-10-21

Modified

2026-10-23

Sources

github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p92p-rxj5-7p2x. This link is maintained to preserve external references. ## Original Description vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-hfwf-hgvp-4rr8