vLLM fixes cross-request cache key collision vulnerability affecting /score and /rerank
vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`
vLLM's flash late-interaction path derives shared query embedding cache keys from the client-controlled X-Request-Id, causing cross-request cache conflicts, incorrect scores, or cache misses in /score and /rerank. Only that flash path is affected; the non-flash path does not create such cross-request cache keys. The maintainers switched to a server-generated request namespace to isolate the cache. The GitHub advisory marks affected versions as < 0.30.0 and the fixed version as 0.30.0.
The advisory gives the affected versions, a reproducible cache key collision mechanism, and the official fix patch, which teams deploying vLLM scoring services can use to troubleshoot.