---
id: GHSA-hfwf-hgvp-4rr8
title: >-
  Duplicate Advisory: vLLM vulnerable to remote denial of service through forged
  multimodal UUID cache desynchronization
summary: >-
  Duplicate Advisory: vLLM vulnerable to remote denial of service through forged
  multimodal UUID cache desynchronization
severity: high
cvss: 7.5
cwe:
  - CWE-345
vendor: vllm
product: vllm
ecosystem: pip
affected:
  - vllm < 0.31.0
published: '2026-10-21'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T20:43:20Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-hfwf-hgvp-4rr8'
references:
  - url: >-
      https://github.com/vllm-project/vllm/security/advisories/GHSA-p92p-rxj5-7p2x
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-114050'
  - url: >-
      https://www.vulncheck.com/advisories/vllm-before-0.31.0-remote-engine-crash-via-forged-multimodal-uuid
  - url: 'https://github.com/advisories/GHSA-hfwf-hgvp-4rr8'
tags:
  - ghsa
  - pip
ingestedAt: '2026-10-23T21:38:13.045Z'
---

## Overview

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-p92p-rxj5-7p2x. This link is maintained to preserve external references.

## Original Description
vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.

## Affected packages

- `vllm < 0.31.0`

## Remediation

Refer to the advisory for the patched release.