vLLM multimodal cache has a desynchronization vulnerability, fixed in 0.28.0
vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core
vLLM's multimodal mirror cache can become desynchronized after a request is rejected: the frontend believes the media is cached, while the engine side has not received the payload, and subsequent requests reusing the same media hash trigger an engine assertion and cause denial of service. The issue involves the default lru multimodal cache. The fix binds frontend cache commits to request admission and isolates receiver-side errors to individual requests. The GitHub announcement marks affected versions as < 0.28.0 and the fixed version as 0.28.0.
The announcement provides the complete trigger chain and affected versions for vLLM's multimodal cache desynchronization vulnerability, allowing teams running self-hosted inference services to determine whether they need to upgrade or add protections.