vLLM: VLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt…
vLLM
More for vLLM RSS feed for vLLM
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Record
- CVE-2026-100647
- Affects
- vLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 26, 2026
- Source last modified
- October 6, 2026
Description
vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP requests with multi-hundred-megabyte salt values that trigger expensive pickle serialization and SHA-256 hashing, stalling the scheduler thread and denying service to all concurrent requests.
Description quoted from the NVD record.
Who is affected
vLLM is software that runs AI language models on your own servers so other apps can send it questions and get answers. This flaw affects versions before 0.29.0. The problem is in how the product handles requests made in the same style as OpenAI and Anthropic AI services: an optional caching value in those requests has no size limit. Someone with no login can send requests carrying values hundreds of megabytes in size, which ties up the part of the product that schedules work and stops it from answering all other requests handled at the same time. This flaw is rated High.
What to do
- If your organization runs vLLM itself, the person who installed it or looks after it should check which version is in use.
- Versions before
0.29.0are affected by this flaw, so that person should update vLLM to version0.29.0or later. - No workaround or setting change is named for this flaw, so updating is the fix to plan for.
- If an IT provider or vendor runs vLLM for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 6, 2026 and reviewed before publishing.