vLLM loose cache_salt validation causes engine crash on LMCache-MP

# vLLM loose cache_salt validation causes engine crash on LMCache-MP

https://gcdradar.vercel.app/incidents/vllm-loose-cache-salt-validation-causes-engine-crash-on-lmca · AIR-2026-0236 · closed 2026-10-05

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-10-05
- AI role: Attack on AI
- Products: vLLM
- CVE ids: CVE-2026-105756
- CVSS: 6.5

## Summary

Incomplete cache_salt validation in vLLM allows specially crafted requests to raise uncaught exceptions, terminating the EngineCore on certain deployments. A patch has been released in version 0.30.0.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-05: CVE-2026-105756: vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError`… (https://github.com/advisories/GHSA-2823-qmq8-rwvj)
- 2026-10-05: CVE-2026-105756: vLLM is an inference and serving engine for large language models. (https://nvd.nist.gov/vuln/detail/CVE-2026-105756)

## Sources

- 2026-10-05 NVD: CVE-2026-105756: vLLM is an inference and serving engine for large language models. https://nvd.nist.gov/vuln/detail/CVE-2026-105756
- 2026-10-05 GitHub Advisory Database: CVE-2026-105756: vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError`… https://github.com/advisories/GHSA-2823-qmq8-rwvj

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.