vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible
    request models accept a non-empty cache_salt value without enforcing the character and length restrictions
    required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a
    salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError
    during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent
    users. This issue is fixed in version 0.30.0. (CVE-2026-105756)

ID	Name	Product	Family	Type	Severity
476114	Chainguard: vllm-openai-cuda-13.0: security update to 0.31.0-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
476114	Chainguard: vllm-openai-cuda-13.0: security update to 0.31.0-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
472959	SCA: security update for vllm (GHSA-2823-qmq8-rwvj)	Tenable Cloud Security	SCA Checks	Local	medium
472959	SCA: security update for vllm (GHSA-2823-qmq8-rwvj)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-105756

medium

Tenable Plugins

medium

medium

medium

medium