CyberRota Analysis
AI-GeneratedvLLM versions prior to 0.30.0 are vulnerable to a denial-of-service condition due to improper handling of the cache_salt value in OpenAI-compatible request models, which can lead to an uncaught ValueError and terminate the EngineCore. This affects deployments using the LMCache-MP connector, potentially disrupting service for all concurrent users. Organizations utilizing vLLM for large language model inference should prioritize upgrading to version 0.30.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)