CVE-2026-114050: vLLM multimodal UUID cache identity flaw leads to engine crash

# CVE-2026-114050: vLLM multimodal UUID cache identity flaw leads to engine crash

https://gcdradar.vercel.app/incidents/cve-2026-114050-vllm-multimodal-uuid-cache-identity-flaw-lea · AIR-2026-1453 · closed 2026-10-21

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-10-21
- AI role: Attack on AI
- Products: vLLM
- CVE ids: CVE-2026-114050
- CVSS: 6.5

## Summary

A cache identity flaw in vLLM before version 0.31.0 enables unauthenticated attackers to desynchronize processor caches. The resulting fatal token-placeholder mismatch crashes the serving instance until a manual restart.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-23: CVE-2026-114050: vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine (https://github.com/advisories/GHSA-p92p-rxj5-7p2x)
- 2026-10-21: CVE-2026-114050: vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits,… (https://nvd.nist.gov/vuln/detail/CVE-2026-114050)

## Sources

- 2026-10-21 NVD: CVE-2026-114050: vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits,… https://nvd.nist.gov/vuln/detail/CVE-2026-114050
- 2026-10-23 GitHub Advisory Database: CVE-2026-114050: vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine https://github.com/advisories/GHSA-p92p-rxj5-7p2x

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.