vLLM fixes EngineCore denial of service caused by overly loose cache_salt validation
Start here
In deployments where vLLM enables the LMCache-MP KV connector, validation of cache_salt is insufficient: a special format triggers an exception in downstream cache key parsing, and the scheduling chain does not isolate it as a single request error, causing the shared EngineCore to exit and interrupt concurrent service. This issue affects availability under specific connector configurations and does not involve data leakage or code execution. The GitHub security advisory marks affected versions as < 0.30.0 and the fixed version as 0.30.0.
Generated by AI from reports · Updated 2 days ago
Progress timeline
- GitHub 安全公告SelectedvLLM fixes denial of service vulnerability where overly loose cache_salt validation allowed EngineCore to be taken down by a single request
On deployments where vLLM enables the LMCache-MP KV connector, cache_salt validation is insufficient. A special format can trigger an exception in downstream cache key parsing, and the scheduling path does not isolate it as a single request error, causing the shared EngineCore to exit and interrupt concurrent services. The impact is availability under specific connector configurations, with no data leakage or code execution involved. The GitHub advisory marks affected versions as < 0.30.0 and the fixed version as 0.30.0.
Related discussion
Attention trend
New sources per day
- Oct 6: 1 new sources (1 outlets, 0 accounts)
- Oct 7: 0 new sources (0 outlets, 0 accounts)
- Oct 8: 0 new sources (0 outlets, 0 accounts)
- Oct 9: 0 new sources (0 outlets, 0 accounts)
- Oct 10: 0 new sources (0 outlets, 0 accounts)
- Oct 11: 0 new sources (0 outlets, 0 accounts)
- Oct 12: 0 new sources (0 outlets, 0 accounts)
- Oct 13: 0 new sources (0 outlets, 0 accounts)
- Oct 14: 0 new sources (0 outlets, 0 accounts)