Vulnerability PYSEC-2026-4362
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
14 days ago
October 21, 2026 at 01:17 AM UTC
No summary available
0.0.1 - 0.30.0
0.0.1 - 0.30.0
Details
vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match cache_salt to a LoRA name to reuse first-block KV state.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
6 days ago
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
0.0.1 - 0.31.0 GHSA-vvpg-rrww-wpmh
0.0.1 - 0.31.0 GHSA-vvpg-rrww-wpmh
Medium Risk
6 days ago
vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine
0.0.1 - 0.31.0 GHSA-8397-8qf6-f2gm
0.0.1 - 0.31.0 GHSA-8397-8qf6-f2gm
Medium Risk
6 days ago
vLLM DeepSeek-OCR image processing vulnerable to denial of service
0.11.1 - 0.31.0 GHSA-gq5q-89c7-vhvx
0.11.1 - 0.31.0 GHSA-gq5q-89c7-vhvx
High Risk
6 days ago
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
0.0.1 - 0.31.0 GHSA-h3rc-j82p-2c3h
0.0.1 - 0.31.0 GHSA-h3rc-j82p-2c3h
High Risk
6 days ago
vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
0.0.1 - 0.31.0 GHSA-6757-hggm-hp2w
0.0.1 - 0.31.0 GHSA-6757-hggm-hp2w
Impacted packages
Timeline
Published
14 days ago
October 21, 2026 at 01:17 AM UTC
Fixed (0.31.0)
1 month ago
October 05, 2026 at 07:40 AM UTC
Last Modified
10 hours ago
November 04, 2026 at 11:00 AM UTC