CVE-2026-114050: vLLM Denial of Service Vulnerability

CVE-2026-114050 Overview

CVE-2026-114050 is a denial-of-service vulnerability in vLLM, a high-throughput inference and serving engine for large language models. Versions prior to 0.31.0 accept a client-supplied multimodal UUID verbatim and use it as the cache identity without validating consistency on cache hits. An unauthenticated attacker can forge a UUID to desynchronize the P0 and P1 processor caches, triggering a fatal token-placeholder mismatch that terminates the serving process. The flaw is tracked under [CWE-345: Insufficient Verification of Data Authenticity].

Critical Impact
A single forged multimodal request can kill the entire vLLM serving instance, requiring an operator restart and interrupting all concurrent inference workloads.

Affected Products

vLLM inference and serving engine versions prior to 0.31.0
Deployments exposing the vLLM OpenAI-compatible API with multimodal input enabled
Downstream model-serving platforms that embed vulnerable vLLM builds

Discovery Timeline

2026-10-21 - CVE-2026-114050 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114050

Vulnerability Analysis

vLLM supports multimodal inputs such as images and audio alongside text prompts. To avoid recomputing expensive feature extraction, the engine caches multimodal embeddings keyed by an identifier derived from the input. In vulnerable builds, the engine accepts the identifier supplied by the client rather than deriving it from the content.

The serving architecture splits work between a P0 preprocessor and a P1 engine worker. Both maintain caches keyed by the multimodal UUID. When a request arrives with a UUID that already exists in one cache but was previously bound to different content, the processors disagree on the token-placeholder layout. The resulting mismatch raises an unrecoverable error that terminates the engine process.

Root Cause

The root cause is a trust boundary violation. The server treats a client-controlled field as a stable, collision-free identifier without any verification. There is no hash binding between the UUID and the underlying multimodal content, and no consistency check validates that a cached entry still corresponds to the data referenced by a new request.

Attack Vector

Exploitation requires network access to the vLLM API and the ability to submit multimodal requests. An attacker submits a request that includes a chosen multimodal UUID and specific content. A follow-up request reuses the same UUID with different content or token structure. On the cache hit, the P0 and P1 caches diverge, producing a token-placeholder mismatch that crashes the engine. All in-flight requests fail until an operator restarts the service.

No authenticated privileges beyond the ability to call the inference endpoint are needed, and no user interaction is required. See the GitHub Security Advisory GHSA-p92p-rxj5-7p2x and the VulnCheck Advisory for VLLM Remote Crash for additional technical context.

Detection Methods for CVE-2026-114050

Indicators of Compromise

Unexpected termination of the vLLM engine process accompanied by token-placeholder mismatch errors in stderr or structured logs.
Repeated client requests reusing identical multimodal UUID values across differing payload content.
Spikes in 5xx responses followed by complete API unavailability from the inference endpoint.

Detection Strategies

Instrument the vLLM server to log the client-supplied multimodal UUID alongside a server-computed content hash and alert on mismatches.
Monitor process supervisors (systemd, Kubernetes, Ray) for abnormal restart loops on vLLM workers.
Correlate API gateway access logs with engine crash timestamps to identify the originating source IP and request pattern.

Monitoring Recommendations

Export vLLM metrics (vllm:engine_*, request latency, request failure counts) to a time-series backend and alert on sudden request-failure spikes.
Enable debug logging for the multimodal cache subsystem in staging to characterize legitimate UUID reuse patterns before deploying detections.
Track per-client UUID reuse rates at the reverse proxy layer and rate-limit or block clients exhibiting rapid reuse of identical UUIDs with varying content.

How to Mitigate CVE-2026-114050

Immediate Actions Required

Upgrade vLLM to version 0.31.0 or later on all serving nodes.
Place vLLM endpoints behind authenticated reverse proxies and restrict exposure to trusted networks until patching is complete.
Audit application code paths that forward client-supplied multimodal UUIDs and strip or regenerate them server-side where feasible.

Patch Information

The upstream fix is included in vLLM 0.31.0. The patched release derives multimodal cache identity from content rather than trusting the client-supplied UUID, and adds a consistency check on cache hits. Review the GitHub Security Advisory GHSA-p92p-rxj5-7p2x for the full remediation details.

Workarounds

Deploy an API gateway rule that rejects requests containing a client-provided multimodal UUID field and allows the server to generate one.
Enforce authentication and per-tenant rate limits on the vLLM inference endpoint to constrain unauthenticated abuse.
Run vLLM under a process supervisor configured for automatic restart to shorten outage duration while upgrades are scheduled.

bash

# Upgrade vLLM to the patched release
pip install --upgrade "vllm>=0.31.0"

# Verify installed version
python -c "import vllm; print(vllm.__version__)"