vLLMPublished 21 Oct 2026NVD status: Received

CVE-2026-114054

vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt.

ComponentvLLM
Severitymedium (CVSS 6.5)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published (NVD)2026-10-21
Affected versions
< 0.31.0
from the CVE Program record written by the CNA that assigned the CVE
Fixed in0.31.0
WeaknessCWE-284
CISA KEVnot listed

NVD description

vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match cache_salt to a LoRA name to reuse first-block KV state.

What to do

  • Upgrade vLLM to 0.31.0 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more