Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-114054

vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match cache_salt to a LoRA name to reuse first-block KV state.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

vllm-project vllm

Default version status: unaffected

  • 0 to < 0.31.0affected
  • 0.31.0unaffected
pkg:pypi/vllm

References