vLLM's October Advisories: One Request Can Kill a Shared Engine

On 5 and 6 October 2026, the vLLM project published eight security advisories. Seven are medium and one is low, but the theme matters more than the scores: several let one ordinary API request take down the EngineCore process that every concurrent user shares, and others let one tenant read or interfere with another tenant's state.

Seven are fixed in vLLM 0.30.0, released on PyPI on 22 September 2026, and one in 0.28.0. The current release is 0.31.0. If you run vLLM as shared inference for several apps or customers, this batch is worth an upgrade window.

What's affected

All eight affect vllm on PyPI and the images built from it.

Engine-fatal or resource exhaustion, triggered by a request:

• CVE-2026-105757: three structured output paths raise uncaught exceptions that escape into the engine loop and kill EngineCore for everyone. The advisory says the client needs nothing beyond the often-default structured output feature. Fixed in 0.30.0.
• CVE-2026-105756: on deployments using the built-in LMCache-MP KV connector, a cache_salt containing /, @, a backslash or NUL passes vLLM's check but fails LMCache's stricter one, and the uncaught ValueError kills the engine. Fixed in 0.30.0.
• CVE-2026-105758: on servers running Qwen2-VL or Qwen3-VL, request-level media_io_kwargs.video.max_frames and fps aren't capped. The reporter measured 74 extra bytes of JSON taking API server memory from 2,271 MiB to 13,629 MiB over unauthenticated POST /tokenize. Affects 0.24.0 onward, fixed in 0.30.0.
• CVE-2026-105760: a caller can pick the GLMGA video sampler with huge fps and max_frames values and burn CPU and memory in the shared media executor. Fixed in 0.30.0.
• CVE-2026-105753: a rejected multimodal request can desync the frontend and engine caches, so a later request with the same media hash trips an assertion in the engine. Default cache configuration. Fixed in 0.28.0.

Cross-request and cross-tenant issues:

• CVE-2026-105754: the scale-out disaggregated route POST /inference/v1/generate trusted caller-supplied multimodal features. Forged fields crashed the engine, and one could poison the shared encoder cache. The advisory notes the /inference prefix is registered by default on generate-capable servers. Fixed in 0.30.0.
• CVE-2026-105755: on /score and /rerank with flash late interaction, the default for supported models, query embeddings were cached under the caller-controlled X-Request-Id header. Reusing a victim's id scored their documents against the attacker's query. Fixed in 0.30.0.
• CVE-2026-105752 (low): on the GPT-OSS Harmony path (POST /v1/responses) with tools, follow-up turns dropped cache_salt, reopening a prefix cache membership oracle between tenants. Fixed in 0.30.0.

How to check if you're exposed

Get the version from the running server or image:

python -c "import vllm; print(vllm.__version__)"
docker exec vllm python -c "import vllm; print(vllm.__version__)"
curl -s http://localhost:8000/version

Below 0.30.0 means at least some of these apply. Which ones depends on how you launched it, so pull the launch command:

ps -eo args | grep -E 'vllm (serve|.*api_server)' | grep -v grep

Read it against these questions:

• Is --api-key set? vLLM's OpenAI-compatible server has no auth unless --api-key or VLLM_API_KEY is set. Without it, every request-triggered bug above is reachable by anyone who can reach the port.
• Which model? A Qwen2-VL or Qwen3-VL model, or any video-capable model, brings in CVE-2026-105758 and CVE-2026-105760. A late-interaction scoring model brings in CVE-2026-105755.
• Is LMCache configured? Look for LMCache in --kv-transfer-config. If present, CVE-2026-105756 applies.
• Multi-tenant? If different customers or apps share one engine, the crash bugs become cross-tenant outages, and the cache bugs become cross-tenant data issues.

What to do now

1. Upgrade to vLLM 0.30.0 or later. 0.31.0 is current. Rebuild any custom images that pin an older base.
2. Set --api-key even on internal networks, and rotate it per client where your gateway allows.
3. Put a gateway in front of vLLM that drops request fields your apps never send. For most deployments that means stripping media_io_kwargs, unknown cache_salt values and client-supplied X-Request-Id headers.
4. Block /inference/ routes at the gateway unless you actually run disaggregated serving.
5. Separate tenants who shouldn't share fate. One engine per trust boundary limits a crash to one customer.
6. Alert on engine restarts. A sudden pattern of EngineCore deaths is how these bugs show up in practice.

Why it matters

Inference servers were built to batch requests from many users through one process, because that's where the GPU efficiency comes from. The flip side is that one bad request can now take everyone down, and shared caches become a channel between tenants. These advisories are mostly about missing request-scoped error boundaries and request fields that reach places they shouldn't.

Several of them are also follow-ups to earlier fixes, such as a frame cap that never reached the Qwen samplers. That pattern of "fixed in one path, missed in the sibling" is common in fast-moving AI infrastructure, so track the whole advisory feed for the projects you run, not just the headline CVE.

Try it yourself

Pull the vLLM image tag you deploy today and list the vllm version inside it. Then see how a container image scan surfaces the same thing across every image in a registry:

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GHSA-85xf-c7hm-whqw: Structured-output errors terminate the shared EngineCore (CVE-2026-105757)
• GHSA-2823-qmq8-rwvj: Loose cache_salt validation kills EngineCore on LMCache-MP (CVE-2026-105756)
• GHSA-x6mc-67gf-chw4: Qwen2-VL and Qwen3-VL video samplers bound on request-controlled max_frames (CVE-2026-105758)
• GHSA-58v5-2m8f-94pr: GLMGA video sampling CPU and memory exhaustion (CVE-2026-105760)
• GHSA-ph3r-5jfg-f84f: Mirrored multimodal IPC cache desync (CVE-2026-105753)
• GHSA-ph72-cqr5-qpp7: Scale-out disaggregated transport trusts caller-supplied features (CVE-2026-105754)
• GHSA-2phq-3phc-84px: Late-interaction scoring cache keyed on caller-controlled request id (CVE-2026-105755)
• GHSA-935w-9g4m-p28p: Harmony tool continuations drop cache_salt (CVE-2026-105752)
• vLLM v0.30.0 release
• vllm on PyPI