---
id: "CVE-2026-129356"
page: "https://infrastack.ai/live/CVE-2026-129356"
kind: "vulnerability"
aliases: ["CVE-2026-129356"]
title: "vLLM: race condition in prefix cache manager can be triggered remotely"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-inference", "ai-tooling", "python", "self-hosted", "vllm"]
not_affected_if: ["other-vllm-versions"]
published_at: "2026-11-15T02:17:20+00:00"
first_seen_at: "2026-11-15T02:35:07+00:00"
updated_at: "2026-11-15T02:36:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129356", "first_seen_at": "2026-11-15T02:35:07+00:00"}]
exploit_sources: []
---

# vLLM: race condition in prefix cache manager can be triggered remotely

Link for people: https://infrastack.ai/live/CVE-2026-129356 (this .md is for agents)

vLLM 0.30.0 and 0.31.0 contain a race condition in the common prefix handling code of single_type_kv_cache_manager.py. A remote attacker may be able to trigger it, with a public exploit reported, but the sources say exploitation is highly complex and difficult.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed vLLM version with `pip show vllm` and look for `0.30.0` or `0.31.0`.
- Confirm whether the affected prefix caching path is in use in your deployment; the sources do not say which configuration enables it.

## Fix

- Upgrade vLLM to `0.32.0`, per the sources.

## Timeline

- 2026-11-15T02:35:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129356

## Documents

- [fix] Patch: github.com https://github.com/vllm-project/vllm/commit/e687a251bb056fa527846633f7a1b0a6c0f42374
- [fix] Release notes: github.com https://github.com/vllm-project/vllm/releases/tag/v0.32.0

## From the sources

A vulnerability was found in vllm-project vllm 0.30.0/0.31.0. This vulnerability affects unknown code of the file single_type_kv_cache_manager.py of the component Common Prefix Handler. The manipulation results in race condition. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 0.32.0 is able to resolve this issue. The patch is identified as e687a251bb056fa527846633f7a1b0a6c0f42374. You should upgrade the affected component.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_