Insufficient Verification of Data Authenticity Affecting vllm package, versions [,0.31.0)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-VLLM-21347785
- published21 Oct 2026
- disclosed21 Oct 2026
- creditC1ves, JSGforever
Introduced: 21 Oct 2026
NewCVE-2026-114050 (opens in a new tab)How to fix?
Upgrade vllm to version 0.31.0 or higher.
Overview
vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs
Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via a forged client-supplied uuid field in multimodal content parts, which vLLM uses verbatim as the cache identity (mm_hash) with no content binding. An attacker sends a small image under a chosen UUID to seed both the P0 (API process) and P1 (EngineCore process) LRU caches, then floods the endpoint with over-long prompts carrying unique UUIDs to evict the seed entry from P0 only - because P0 insertion occurs during chat rendering before prompt-length validation, so rejected requests still populate P0 without reaching the engine. A final request sends a large image under the original UUID: P0 misses and splices N_B placeholder tokens into the prompt, but P1 hits and silently substitutes the stale N_A-row tensor, causing _merge_multimodal_embeddings in vllm/model_executor/models/utils.py to raise a ValueError that propagates uncaught through the EngineCore busy loop, triggers _send_engine_dead(), and permanently kills the serving instance until it is manually restarted.