Executive brief
vLLM is an open-source inference engine for running large language models. An unauthenticated attacker can crash or severely stall the service by sending API requests with extremely large cache_salt values, causing the server to hang and become unavailable to all other users. No authentication or special configuration is required to exploit this vulnerability.
Technical details
The cache_salt parameter on OpenAI-compatible and Anthropic API endpoints lacks maximum length validation and is processed during request construction on vLLM's single EngineCore scheduler thread. The unvalidated salt is serialized with pickle and hashed with SHA-256, consuming CPU proportionally to the salt size; multi-hundred-megabyte payloads stall the shared scheduler thread and cause service degradation for concurrent requests. A fix is available in version 0.29.0 and later.
Affected products
- vLLM Project vLLM before 0.29.0
Timeline
- 2026-09-26: disclosed
- 2026-09-12: patched: vLLM 0.29.0 released