{"id":"CVE-2026-129356","kind":"vulnerability","aliases":["CVE-2026-129356"],"related":[],"title":"vLLM: race condition in prefix cache manager can be triggered remotely","description":"A vulnerability was found in vllm-project vllm 0.30.0/0.31.0. This vulnerability affects unknown code of the file single_type_kv_cache_manager.py of the component Common Prefix Handler. The manipulation results in race condition. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 0.32.0 is able to resolve this issue. The patch is identified as e687a251bb056fa527846633f7a1b0a6c0f42374. You should upgrade the affected component.","summary":"vLLM 0.30.0 and 0.31.0 contain a race condition in the common prefix handling code of single_type_kv_cache_manager.py. A remote attacker may be able to trigger it, with a public exploit reported, but the sources say exploitation is highly complex and difficult.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-inference","ai-tooling","python","self-hosted","vllm"],"not_affected_if":["other-vllm-versions"],"how_to_check":"- Check the installed vLLM version with `pip show vllm` and look for `0.30.0` or `0.31.0`.\n- Confirm whether the affected prefix caching path is in use in your deployment; the sources do not say which configuration enables it.","fix":"- Upgrade vLLM to `0.32.0`, per the sources.","status":"open","published_at":"2026-11-15T02:17:20+00:00","first_seen_at":"2026-11-15T02:35:07+00:00","triaged_at":"2026-11-15T02:36:31+00:00","updated_at":"2026-11-15T02:36:31+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-15T02:36:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vLLM to `0.32.0`, per the sources.","reach":"internet","title":"vLLM: race condition in prefix cache manager can be triggered remotely","impact":"medium","summary":"vLLM 0.30.0 and 0.31.0 contain a race condition in the common prefix handling code of single_type_kv_cache_manager.py. A remote attacker may be able to trigger it, with a public exploit reported, but the sources say exploitation is highly complex and difficult.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["vllm","python","ai-inference","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"race condition may cause incorrect cache behavior or crashes; impact unclear","analyst_note":"Confirm exact impact of the race condition and whether prefix caching must be enabled; check the patch commit e687a251bb056fa527846633f7a1b0a6c0f42374 and release notes on github.com.","how_to_check":"- Check the installed vLLM version with `pip show vllm` and look for `0.30.0` or `0.31.0`.\n- Confirm whether the affected prefix caching path is in use in your deployment; the sources do not say which configuration enables it.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-vllm-versions"],"who_is_affected":"Teams running vLLM 0.30.0 or 0.31.0 as a model serving backend, especially where the server accepts requests from outside the network. The sources do not state whether a particular configuration is required to reach the flawed code. Deployments on other vLLM versions are not named as affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000785,"input_tokens":4673,"output_tokens":636,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129356':14A,17A '-2026':13A,16A '/0.31.0':79C '0.30.0':30B,78C '0.31.0':32B '0.32.0':136C 'abl':50B,138C 'affect':82C,153C 'ai':19B,22B 'ai-infer':18B 'ai-tool':21B 'attack':47B,102C,108C 'cach':6A 'code':42B,84C 'common':39B,92C 'complex':66B,114C 'compon':91C,154C 'condit':3A,36B,100C 'contain':33B 'could':130C 'cve':12A,15A 'difficult':68B,122C 'e687a251bb056fa527846633f7a1b0a6c0f42374':148C 'exploit':57B,63B,120C,124C 'file':87C 'found':72C 'handl':41B 'handler':94C 'high':65B,113C 'host':27B 'identifi':146C 'infer':20B 'issu':142C 'made':127C 'manag':7A 'manipul':96C 'may':48B,103C 'natur':111C 'patch':144C 'perform':105C 'prefix':5A,40B,93C 'project':76C 'public':56B,128C 'python':24B 'race':2A,35B,99C 'remot':11A,46B,107C 'report':58B 'resolv':140C 'result':97C 'say':62B 'self':26B 'self-host':25B 'single_type_kv_cache_manager.py':44B,88C 'sourc':61B 'state':117C 'tool':23B 'trigger':10A,52B 'unknown':83C 'upgrad':133C,151C 'use':132C 'version':135C 'vllm':1A,28B,29B,75C,77C 'vllm-project':74C 'vulner':70C,81C","nicknames":[],"mitigations":[],"who_affected":"Teams running vLLM 0.30.0 or 0.31.0 as a model serving backend, especially where the server accepts requests from outside the network. The sources do not state whether a particular configuration is required to reach the flawed code. Deployments on other vLLM versions are not named as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiinference","aitooling","medium","python","selfhosted","vllm"],"campaign_type":null,"search_a":"'-129356':14A,17A '-2026':13A,16A 'cach':6A 'condit':3A 'cve':12A,15A 'manag':7A 'prefix':5A 'race':2A 'remot':11A 'trigger':10A 'vllm':1A","search_b":"'0.30.0':30B '0.31.0':32B 'abl':50B 'ai':19B,22B 'ai-infer':18B 'ai-tool':21B 'attack':47B 'code':42B 'common':39B 'complex':66B 'condit':36B 'contain':33B 'difficult':68B 'exploit':57B,63B 'handl':41B 'high':65B 'host':27B 'infer':20B 'may':48B 'prefix':40B 'public':56B 'python':24B 'race':35B 'remot':46B 'report':58B 'say':62B 'self':26B 'self-host':25B 'single_type_kv_cache_manager.py':44B 'sourc':61B 'tool':23B 'trigger':52B 'vllm':28B,29B","search_c":"'/0.31.0':79C '0.30.0':78C '0.32.0':136C 'abl':138C 'affect':82C,153C 'attack':102C,108C 'code':84C 'common':92C 'complex':114C 'compon':91C,154C 'condit':100C 'could':130C 'difficult':122C 'e687a251bb056fa527846633f7a1b0a6c0f42374':148C 'exploit':120C,124C 'file':87C 'found':72C 'handler':94C 'high':113C 'identifi':146C 'issu':142C 'made':127C 'manipul':96C 'may':103C 'natur':111C 'patch':144C 'perform':105C 'prefix':93C 'project':76C 'public':128C 'race':99C 'remot':107C 'resolv':140C 'result':97C 'single_type_kv_cache_manager.py':88C 'state':117C 'unknown':83C 'upgrad':133C,151C 'use':132C 'version':135C 'vllm':75C,77C 'vllm-project':74C 'vulner':70C,81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T02:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129356","severity":null,"published_at":"2026-11-15T02:17:20+00:00","modified_at":"2026-11-15T02:17:21+00:00","first_seen_at":"2026-11-15T02:35:07+00:00","fetched_at":"2026-11-15T02:35:07+00:00","note":null}],"documents":[{"id":160174,"url":"https://github.com/vllm-project/vllm/commit/e687a251bb056fa527846633f7a1b0a6c0f42374","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":47628,"url":"https://github.com/vllm-project/vllm/releases/tag/v0.32.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}