## vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

- 種別: advisory
- 重大度: medium
- 関連技術: python
- CVE: CVE-2026-114050
- 公開日時: 2026-10-23T20:43:44.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-p92p-rxj5-7p2x)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-p92p-rxj5-7p2x

影響: pip:vllm < 0.31.0 → 0.31.0
Multimodal content parts (image_url, video_url, input_audio, ...) accept a user-supplied uuid field that vLLM uses verbatim as the item's cache identity (mm_hash). The two frontend/engine processor caches (P0 "sender" cache in the API process, P1 "receiver" cache in the EngineCore process) are independent LRU caches whose evictions are not synchronized, and the P1 hit path performs zero consistency validation — it silently substitutes the cached item's tensor data for whatever the current reque…