vLLM: Forged multimodal UUID and P0/P1 processor cache eviction drift allow unauthenticated clients to remotely crash the entire engine
vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine
vLLM before 0.31.0 has a vulnerability that allows an unauthenticated client to deterministically crash the entire serving engine remotely using forged multimodal UUIDs and cache drift. The uuid field of a multimodal content part is used as-is as a cache identifier, while the API process's P0 send cache and the EngineCore process's P1 receive cache are independent LRU caches that evict out of sync, and the P1 hit path performs no consistency check. The attack has three steps: first seed the target uuid with a small image, then send about 70 requests with extremely long prompts, which are rejected with 400 only after being written to the P0 cache, thereby evicting only the target entry from P0; finally send a large image with the same uuid, and the engine fills 2048 placeholders with the old 4-row tensor, triggering a ValueError that kills the EngineCore process, requiring a full restart to recover. The advisory gives four remediation recommendations, and the fix was released with vLLM 0.31.0.
The advisory fully presents the exploit chain from cache drift to engine crash and the validation environment, which teams deploying vLLM multimodal services can use to check versions and exposure.