vLLM discloses shared cache key trust boundary flaw that can cause cross-request cache confusion
vLLM：共享缓存键信任边界导致跨请求混淆
AI summary
vLLM's multimodal EXIF hash and prefix cache extra keys accept client-controlled values and are not sufficiently bound to the request body and media content, which may cause cross-request cache confusion and break the isolation boundary between media processing and prefix caching. The GitHub advisory marks affected versions as < 0.31.0 and the fixed version as 0.31.0.
Why it was selected
The announcement gives the trigger conditions and CVSS scores for two cache key trust boundary flaws, along with directly applicable fix patches, and teams deploying vLLM can use this for self-inspection.
Read original