CVE catalog
CVE-2026-105756
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length rest
- Severity
- Medium · CVSS 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.33% · Oct 25, 2026
A flaw was found in vllm. An authenticated remote attacker can cause a Denial of Service (DoS) by submitting an API request containing an invalid cache salt parameter with forbidden characters or excessive length. Because the application fails to validate the parameter before passing it to the internal caching component, the malformed input triggers an unhandled error during cache lookup. This failure causes the core engine process to terminate, disrupting service for all active users. vllm: vllm: Denial of Service via unvalidated cache salt in API requests A moderate severity denial-of-service vulnerability was found in vLLM, as shipped in Red Hat AI Inference Server and Red Hat OpenShift AI (RHOAI). vLLM's OpenAI-compatible API endpoints accept a client-supplied cache_salt parameter that is validated only as a non-empty string, without character or length restrictions. On deployments where the LMCache-MP KV connector is enabled, the value is forwarded unvalidated into the scheduler's cache lookup, where the downstream LMCache library raises a ValueError for salts that contain forbidden characters (for example '@', '/', backslash, or NUL) or exceed 128 characters. Because this exception is not handled at the request level, the EngineCore process treats it as fatal and terminates, disrupting service for all concurrent users. An authenticated remote attacker with access to the inference API can trigger this crash with a single crafted request. The flaw affects availability only, with no impact on confidentiality or integrity (CVSS 3.1 score of 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which matches the upstream severity rating. Because the impact is moderate and the CVSS score is below 7.0, the fix for the affected Red Hat AI Inference Server and Red Hat OpenShift AI components has been deferred. The residual risk is limited to a denial of service against a single vLLM serving instance by an already-authenticated API user, and only on deployments that use the LMCache-MP connector. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | vllm | Not reported | 0.30.0 | fixed |
| PyPI | vllm | Not reported | 0.0.1 | vulnerable |
| PyPI | vllm | Not reported | 0.1.0 | vulnerable |
| PyPI | vllm | Not reported | 0.1.1 | vulnerable |
| PyPI | vllm | Not reported | 0.1.2 | vulnerable |
| PyPI | vllm | Not reported | 0.1.3 | vulnerable |
| PyPI | vllm | Not reported | 0.1.4 | vulnerable |
| PyPI | vllm | Not reported | 0.1.5 | vulnerable |
| PyPI | vllm | Not reported | 0.1.6 | vulnerable |
| PyPI | vllm | Not reported | 0.1.7 | vulnerable |
| PyPI | vllm | Not reported | 0.10.0 | vulnerable |
| PyPI | vllm | Not reported | 0.10.1 | vulnerable |
| PyPI | vllm | Not reported | 0.10.1.1 | vulnerable |
| PyPI | vllm | Not reported | 0.10.2 | vulnerable |
| PyPI | vllm | Not reported | 0.11.0 | vulnerable |
| PyPI | vllm | Not reported | 0.11.1 | vulnerable |
| PyPI | vllm | Not reported | 0.11.2 | vulnerable |
| PyPI | vllm | Not reported | 0.12.0 | vulnerable |
| PyPI | vllm | Not reported | 0.13.0 | vulnerable |
| PyPI | vllm | Not reported | 0.14.0 | vulnerable |
| PyPI | vllm | Not reported | 0.14.1 | vulnerable |
| PyPI | vllm | Not reported | 0.15.0 | vulnerable |
| PyPI | vllm | Not reported | 0.15.1 | vulnerable |
| PyPI | vllm | Not reported | 0.16.0 | vulnerable |
| PyPI | vllm | Not reported | 0.17.0 | vulnerable |
| PyPI | vllm | Not reported | 0.17.1 | vulnerable |
| PyPI | vllm | Not reported | 0.18.0 | vulnerable |
| PyPI | vllm | Not reported | 0.18.1 | vulnerable |
| PyPI | vllm | Not reported | 0.19.0 | vulnerable |
| PyPI | vllm | Not reported | 0.19.1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.0 | vulnerable |
| PyPI | vllm | Not reported | 0.2.1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.1.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.2 | vulnerable |
| PyPI | vllm | Not reported | 0.2.3 | vulnerable |
| PyPI | vllm | Not reported | 0.2.4 | vulnerable |
| PyPI | vllm | Not reported | 0.2.5 | vulnerable |
| PyPI | vllm | Not reported | 0.2.6 | vulnerable |
| PyPI | vllm | Not reported | 0.2.7 | vulnerable |
| PyPI | vllm | Not reported | 0.20.0 | vulnerable |
| PyPI | vllm | Not reported | 0.20.1 | vulnerable |
| PyPI | vllm | Not reported | 0.20.2 | vulnerable |
| PyPI | vllm | Not reported | 0.21.0 | vulnerable |
| PyPI | vllm | Not reported | 0.22.0 | vulnerable |
| PyPI | vllm | Not reported | 0.22.1 | vulnerable |
| PyPI | vllm | Not reported | 0.23.0 | vulnerable |
| PyPI | vllm | Not reported | 0.24.0 | vulnerable |
| PyPI | vllm | Not reported | 0.25.0 | vulnerable |
| PyPI | vllm | Not reported | 0.25.1 | vulnerable |
| PyPI | vllm | Not reported | 0.26.0 | vulnerable |
| PyPI | vllm | Not reported | 0.27.0 | vulnerable |
| PyPI | vllm | Not reported | 0.27.1 | vulnerable |
| PyPI | vllm | Not reported | 0.28.0 | vulnerable |
| PyPI | vllm | Not reported | 0.29.0 | vulnerable |
| PyPI | vllm | Not reported | 0.3.0 | vulnerable |
| PyPI | vllm | Not reported | 0.3.1 | vulnerable |
| PyPI | vllm | Not reported | 0.3.2 | vulnerable |
| PyPI | vllm | Not reported | 0.3.3 | vulnerable |
| PyPI | vllm | Not reported | 0.4.0 | vulnerable |
| PyPI | vllm | Not reported | 0.4.0.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.4.1 | vulnerable |
| PyPI | vllm | Not reported | 0.4.2 | vulnerable |
| PyPI | vllm | Not reported | 0.4.3 | vulnerable |
| PyPI | vllm | Not reported | 0.5.0 | vulnerable |
| PyPI | vllm | Not reported | 0.5.0.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.2 | vulnerable |
| PyPI | vllm | Not reported | 0.5.3 | vulnerable |
| PyPI | vllm | Not reported | 0.5.3.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.4 | vulnerable |
| PyPI | vllm | Not reported | 0.5.5 | vulnerable |
| PyPI | vllm | Not reported | 0.6.0 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1.post2 | vulnerable |
| PyPI | vllm | Not reported | 0.6.2 | vulnerable |
| PyPI | vllm | Not reported | 0.6.3 | vulnerable |
| PyPI | vllm | Not reported | 0.6.3.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.4 | vulnerable |
| PyPI | vllm | Not reported | 0.6.4.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.5 | vulnerable |
| PyPI | vllm | Not reported | 0.6.6 | vulnerable |
| PyPI | vllm | Not reported | 0.6.6.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.7.0 | vulnerable |
| PyPI | vllm | Not reported | 0.7.1 | vulnerable |
| PyPI | vllm | Not reported | 0.7.2 | vulnerable |
| PyPI | vllm | Not reported | 0.7.3 | vulnerable |
| PyPI | vllm | Not reported | 0.8.0 | vulnerable |
| PyPI | vllm | Not reported | 0.8.1 | vulnerable |
| PyPI | vllm | Not reported | 0.8.2 | vulnerable |
| PyPI | vllm | Not reported | 0.8.3 | vulnerable |
| PyPI | vllm | Not reported | 0.8.4 | vulnerable |
| PyPI | vllm | Not reported | 0.8.5 | vulnerable |
| PyPI | vllm | Not reported | 0.8.5.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.0 | vulnerable |
| PyPI | vllm | Not reported | 0.9.0.1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.2 | vulnerable |
| PyPI | vllm | Not reported | 0.30.0 | fixed |
| PyPI | vllm | Not reported | 0.0.1 | vulnerable |
| PyPI | vllm | Not reported | 0.1.0 | vulnerable |
| PyPI | vllm | Not reported | 0.1.1 | vulnerable |
| PyPI | vllm | Not reported | 0.1.2 | vulnerable |
| PyPI | vllm | Not reported | 0.1.3 | vulnerable |
| PyPI | vllm | Not reported | 0.1.4 | vulnerable |
| PyPI | vllm | Not reported | 0.1.5 | vulnerable |
| PyPI | vllm | Not reported | 0.1.6 | vulnerable |
| PyPI | vllm | Not reported | 0.1.7 | vulnerable |
| PyPI | vllm | Not reported | 0.10.0 | vulnerable |
| PyPI | vllm | Not reported | 0.10.1 | vulnerable |
| PyPI | vllm | Not reported | 0.10.1.1 | vulnerable |
| PyPI | vllm | Not reported | 0.10.2 | vulnerable |
| PyPI | vllm | Not reported | 0.11.0 | vulnerable |
| PyPI | vllm | Not reported | 0.11.1 | vulnerable |
| PyPI | vllm | Not reported | 0.11.2 | vulnerable |
| PyPI | vllm | Not reported | 0.12.0 | vulnerable |
| PyPI | vllm | Not reported | 0.13.0 | vulnerable |
| PyPI | vllm | Not reported | 0.14.0 | vulnerable |
| PyPI | vllm | Not reported | 0.14.1 | vulnerable |
| PyPI | vllm | Not reported | 0.15.0 | vulnerable |
| PyPI | vllm | Not reported | 0.15.1 | vulnerable |
| PyPI | vllm | Not reported | 0.16.0 | vulnerable |
| PyPI | vllm | Not reported | 0.17.0 | vulnerable |
| PyPI | vllm | Not reported | 0.17.1 | vulnerable |
| PyPI | vllm | Not reported | 0.18.0 | vulnerable |
| PyPI | vllm | Not reported | 0.18.1 | vulnerable |
| PyPI | vllm | Not reported | 0.19.0 | vulnerable |
| PyPI | vllm | Not reported | 0.19.1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.0 | vulnerable |
| PyPI | vllm | Not reported | 0.2.1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.1.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.2 | vulnerable |
| PyPI | vllm | Not reported | 0.2.3 | vulnerable |
| PyPI | vllm | Not reported | 0.2.4 | vulnerable |
| PyPI | vllm | Not reported | 0.2.5 | vulnerable |
| PyPI | vllm | Not reported | 0.2.6 | vulnerable |
| PyPI | vllm | Not reported | 0.2.7 | vulnerable |
| PyPI | vllm | Not reported | 0.20.0 | vulnerable |
| PyPI | vllm | Not reported | 0.20.1 | vulnerable |
| PyPI | vllm | Not reported | 0.20.2 | vulnerable |
| PyPI | vllm | Not reported | 0.21.0 | vulnerable |
| PyPI | vllm | Not reported | 0.22.0 | vulnerable |
| PyPI | vllm | Not reported | 0.22.1 | vulnerable |
| PyPI | vllm | Not reported | 0.23.0 | vulnerable |
| PyPI | vllm | Not reported | 0.24.0 | vulnerable |
| PyPI | vllm | Not reported | 0.25.0 | vulnerable |
| PyPI | vllm | Not reported | 0.25.1 | vulnerable |
| PyPI | vllm | Not reported | 0.26.0 | vulnerable |
| PyPI | vllm | Not reported | 0.27.0 | vulnerable |
| PyPI | vllm | Not reported | 0.27.1 | vulnerable |
| PyPI | vllm | Not reported | 0.28.0 | vulnerable |
| PyPI | vllm | Not reported | 0.29.0 | vulnerable |
| PyPI | vllm | Not reported | 0.3.0 | vulnerable |
| PyPI | vllm | Not reported | 0.3.1 | vulnerable |
| PyPI | vllm | Not reported | 0.3.2 | vulnerable |
| PyPI | vllm | Not reported | 0.3.3 | vulnerable |
| PyPI | vllm | Not reported | 0.4.0 | vulnerable |
| PyPI | vllm | Not reported | 0.4.0.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.4.1 | vulnerable |
| PyPI | vllm | Not reported | 0.4.2 | vulnerable |
| PyPI | vllm | Not reported | 0.4.3 | vulnerable |
| PyPI | vllm | Not reported | 0.5.0 | vulnerable |
| PyPI | vllm | Not reported | 0.5.0.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.2 | vulnerable |
| PyPI | vllm | Not reported | 0.5.3 | vulnerable |
| PyPI | vllm | Not reported | 0.5.3.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.4 | vulnerable |
| PyPI | vllm | Not reported | 0.5.5 | vulnerable |
| PyPI | vllm | Not reported | 0.6.0 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1.post2 | vulnerable |
| PyPI | vllm | Not reported | 0.6.2 | vulnerable |
| PyPI | vllm | Not reported | 0.6.3 | vulnerable |
| PyPI | vllm | Not reported | 0.6.3.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.4 | vulnerable |
| PyPI | vllm | Not reported | 0.6.4.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.5 | vulnerable |
| PyPI | vllm | Not reported | 0.6.6 | vulnerable |
| PyPI | vllm | Not reported | 0.6.6.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.7.0 | vulnerable |
| PyPI | vllm | Not reported | 0.7.1 | vulnerable |
| PyPI | vllm | Not reported | 0.7.2 | vulnerable |
| PyPI | vllm | Not reported | 0.7.3 | vulnerable |
| PyPI | vllm | Not reported | 0.8.0 | vulnerable |
| PyPI | vllm | Not reported | 0.8.1 | vulnerable |
| PyPI | vllm | Not reported | 0.8.2 | vulnerable |
| PyPI | vllm | Not reported | 0.8.3 | vulnerable |
| PyPI | vllm | Not reported | 0.8.4 | vulnerable |
| PyPI | vllm | Not reported | 0.8.5 | vulnerable |
| PyPI | vllm | Not reported | 0.8.5.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.0 | vulnerable |
| PyPI | vllm | Not reported | 0.9.0.1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.2 | vulnerable |
| PyPI | vllm | Not reported | 0.30.0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | vllm | cpe | Not reported | 0.30.0 | Not reported | NVD-CVE-2026-105756 | Not reported |
| PyPI | vllm | PyPI | Not reported | 0.30.0 | Not reported | PYSEC-2026-4306 | Not reported |
| PyPI | vllm | PyPI | Not reported | 0.30.0 | Not reported | GHSA-2823-QMQ8-RWVJ | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://github.com/advisories/GHSA-2823-qmq8-rwvj]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-105756]
- [https://osv.dev/vulnerability/PYSEC-2026-4306]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105756.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3754.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]