vLLM multimodal cache desynchronization can cause engine crashes
Start here
vLLM's multimodal cache has a consistency flaw: under default configuration, an unauthenticated remote client can crash the shared inference engine, requiring a service restart. The GitHub security advisory marks affected versions as < 0.31.0, with the fix in 0.31.0, involving consistency checks between multimodal UUIDs and the processor cache. An earlier advisory stated that the multimodal mirror cache could become out of sync after a request is rejected, where the frontend believes media is cached while the engine side has not received the payload; subsequent requests reusing the same media hash trigger an engine assertion and cause denial of service, involving the default lru multimodal cache, with affected versions < 0.28.0 and the fix in 0.28.0, which binds frontend cache commits to request admission and isolates receiving-side errors to individual requests.
Generated by AI from reports · Updated 2 days ago
Progress timeline
- GitHub 安全公告SelectedvLLM multimodal cache consistency flaw can cause engine crash; official disclosure and fix provided
vLLM's multimodal cache identity and eviction order have a consistency flaw. In default configurations, an unauthenticated remote client can crash a shared inference engine, requiring service restart. The fix involves consistency checks for multimodal UUIDs and processor cache. The GitHub advisory marks affected versions as < 0.31.0, with the fix in version 0.31.0.
- GitHub 安全公告SelectedvLLM multimodal cache has a desynchronization vulnerability, fixed in 0.28.0
vLLM's multimodal mirror cache can become desynchronized after a request is rejected: the frontend believes the media is cached, while the engine side has not received the payload, and subsequent requests reusing the same media hash trigger an engine assertion and cause denial of service. The issue involves the default lru multimodal cache. The fix binds frontend cache commits to request admission and isolates receiver-side errors to individual requests. The GitHub announcement marks affected versions as < 0.28.0 and the fixed version as 0.28.0.
Related discussion
Attention trend
New sources per day
- Oct 6New1 sources (1 outlets,0 accounts)
- Oct 7New0 sources (0 outlets,0 accounts)
- Oct 8New0 sources (0 outlets,0 accounts)
- Oct 9New0 sources (0 outlets,0 accounts)
- Oct 10New0 sources (0 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New0 sources (0 outlets,0 accounts)
- Oct 13New0 sources (0 outlets,0 accounts)