vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0.
References
| Link | Resource |
|---|---|
| https://github.com/vllm-project/vllm/commit/e962733e08d10f7ca65dac4df99e116460b8b174 | Patch |
| https://github.com/vllm-project/vllm/pull/51444 | Issue Tracking Patch |
| https://github.com/vllm-project/vllm/releases/tag/v0.30.0 | Release Notes |
| https://github.com/vllm-project/vllm/security/advisories/GHSA-2823-qmq8-rwvj | Mitigation Vendor Advisory |
Configurations
History
08 Oct 2026, 01:28
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Vllm vllm
Vllm |
|
| CPE | cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:* | |
| References | () https://github.com/vllm-project/vllm/commit/e962733e08d10f7ca65dac4df99e116460b8b174 - Patch | |
| References | () https://github.com/vllm-project/vllm/pull/51444 - Issue Tracking, Patch | |
| References | () https://github.com/vllm-project/vllm/releases/tag/v0.30.0 - Release Notes | |
| References | () https://github.com/vllm-project/vllm/security/advisories/GHSA-2823-qmq8-rwvj - Mitigation, Vendor Advisory |
05 Oct 2026, 23:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-05 23:17
Updated : 2026-10-08 01:28
NVD link : CVE-2026-105756
Mitre link : CVE-2026-105756
CVE.ORG link : CVE-2026-105756
JSON object : View
Products Affected
vllm
- vllm