CyberRota Analysis
AI-GeneratedThe vulnerability affects vLLM, an inference engine for large language models, where improper handling of the X-Request-Id header allows an attacker to manipulate cached query embeddings, potentially scoring a victim's documents against the attacker's query. This can lead to unauthorized access to sensitive data and incorrect scoring results. Organizations using versions prior to 0.30.0 should prioritize updating to the latest version to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can overwrite the cached query embedding so the victim's documents are scored against the attacker's query, and shared use counters can also cause a late-interaction cache-miss error. This issue is fixed in version 0.30.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)