Live › vulnerability › GHSA-hfwf-hgvp-4rr8
Go to dashboardThis advisory is withdrawn as a duplicate of GHSA-p92p-rxj5-7p2x; the original text says vLLM before 0.31.0 trusts a client-supplied multimodal uuid as cache identity. An unauthenticated attacker can desynchronize the processor caches and crash the whole serving instance until restart.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 20:45 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| vllm | pypi | < 0.31.0 | – |
pip show vllm (affected if the version is below 0.31.0)
Check the installed version against the advisory GHSA-p92p-rxj5-7p2x, which carries the live record
Upgrade vllm to 0.31.0 or later, as the original advisory states; confirm the fixed version in GHSA-p92p-rxj5-7p2x
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-p92p-rxj5-7p2x. This link is maintained to preserve external references.
vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.
This page as .md · .json · in your agent: get_signal("GHSA-hfwf-hgvp-4rr8")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.