vLLM multimodal transmission trusts caller fields, 0.30.0 fixes crash and cache poisoning vulnerabilities
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
vLLM's scale-out multimodal transport treats caller-supplied features as trusted rendering results without binding validation against the current model's rendering contract. Five trust boundary flaws can let authenticated requests cause shared engine crashes, cross-request encoder cache poisoning or disclosure, and loss of transport integrity. Report submitted by Patch the Planet (a Trail of Bits and OpenAI collaboration), discovered using GPT-5.5-Cyber. The GitHub advisory marks affected versions as < 0.30.0 and the fixed version as 0.30.0.
The announcement itemizes the trigger points and impact of five forged fields, along with a fix patch; teams deploying vLLM multimodal inference can use this to investigate similar trust boundaries.