Bug 2546180 (CVE-2026-105753) - CVE-2026-105753 vllm: vllm: Denial of Service via multimodal cache desynchronization
Summary: CVE-2026-105753 vllm: vllm: Denial of Service via multimodal cache desynchron...
Keywords:
Status: NEW
Alias: CVE-2026-105753
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-05 22:51 UTC by OSIDB Bzimport
Modified: 2026-10-05 22:56 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-05 22:51:15 UTC
vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if that request is rejected. A later request reusing the same media hash causes MultiModalProcessorSenderCache to send no payload and MultiModalReceiverCache to reach an assertion with the message "Expected a cached item," producing a shared-service availability failure. This issue is fixed in version 0.28.0.


Note You need to log in before you can comment on or make changes to this bug.