Six vLLM advisories show single requests can kill the engine

Six security advisories for the vLLM inference server were published on 5 October 2026 in the GitHub Advisory Database, covering flaws that each allow an ordinary API request to crash a shared engine process, corrupt another user's results or exhaust server memory. All six are listed as affecting the pip package vllm at version 0.25.1 and earlier, confirmed on commit 752a3a504485. The advisories state the lower bound of affected versions predates 0.25.1 and ask maintainers to confirm how far back each path reaches.

Three of the reports describe what the advisories call engine-fatal denial of service, where an exception escapes the boundary of the request that caused it and reaches EngineCore's top-level handler, which treats any uncaught exception as fatal and kills the whole engine process.

In CVE-2026-105756, vLLM's OpenAI-compatible request models accept a client-supplied cache_salt field and check only that it is a non-empty string. On deployments using the built-in LMCache-MP KV connector, the advisory says the value is forwarded unguarded into the scheduler's cache lookup, where the LMCache library applies a stricter check and raises a ValueError for salts containing @, /, \ or NUL, or longer than 128 characters. According to the advisory, a single request with cache_salt="/" takes down the engine for all concurrent users.

CVE-2026-105757 reports three structured-output paths where a request-scoped validation failure instead propagates as an uncaught exception. The advisory says the sites are distinct from earlier published fixes, because the grammar-completion check on 0.25.1 still catches only TimeoutError.

CVE-2026-105755 concerns integrity rather than availability. On /score and /rerank deployments with flash late interaction enabled — which the advisory says is the default for supported models — the worker caches query embeddings under a key derived from the caller-controlled X-Request-Id header. A second request reusing a victim's header value can overwrite the cached query, so the victim's documents are scored against the attacker's query. The advisory notes the data-parallel router pins all requests sharing a cache key to the same engine, making the collision deterministic. Depending on timing, one request can also exhaust a shared use counter and force the other into a cache-miss error.

CVE-2026-105754 covers vLLM's disaggregated scale-out transport, where the generate route decodes a caller-supplied features object — serialised encoder tensors, multimodal hashes and placeholder ranges — and forwards it to the engine as if it had come from the trusted renderer. The advisory describes five sites, including engine-fatal crashes, silent cross-request encoder-cache poisoning and disclosure, and transport-level integrity loss.

Two further advisories concern video handling. CVE-2026-105760 says request-level media_io_kwargs let a caller select the GLMGA sampler with large fps and max_frames values, building and deduplicating an oversized index list before decoding, causing partial denial of service. CVE-2026-105758 reports that the Qwen2-VL and Qwen3-VL samplers bound on max_frames, which an existing num_frames clamp does not reach. The reporter measured server peak memory rising from 2,271 MiB to 13,629 MiB from 74 extra bytes of JSON sent to /tokenize, and notes that a default vllm serve is unauthenticated and that /tokenize and /invocations fall outside the guarded prefixes even when an API key is set. The advisory says the Rust frontend is not affected because it rejects media_io_kwargs.