vLLM fixes denial of service vulnerability where overly loose cache_salt validation allowed EngineCore to be taken down by a single request
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
On deployments where vLLM enables the LMCache-MP KV connector, cache_salt validation is insufficient. A special format can trigger an exception in downstream cache key parsing, and the scheduling path does not isolate it as a single request error, causing the shared EngineCore to exit and interrupt concurrent services. The impact is availability under specific connector configurations, with no data leakage or code execution involved. The GitHub advisory marks affected versions as < 0.30.0 and the fixed version as 0.30.0.
The announcement gives the complete call chain from request fields to EngineCore crash and two fix recommendations, and teams running vLLM inference services can use this to investigate their own deployments.