CVE-2026-114050: vLLM forged multimodal UUID crashes

Q: Is CVE-2026-114050 actively exploited?

No confirmed active exploitation of CVE-2026-114050 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-114050?

1) Upgrade vLLM to 0.31.0 or later, which adds consistency checks on multimodal cache identity. 2) Until patched, put vLLM behind an authenticating API gateway and do not expose it directly to untrusted networks. 3) Where possible, strip or override client-supplied multimodal UUID fields at the gateway so the server generates its own identifiers. 4) Rate-limit and validate multimodal requests, and block repeated requests that reuse identical UUIDs with differing content. 5) Configure automatic restart and health checks (Kubernetes liveness probes or a process supervisor) to shorten outage windows, and run multiple replicas behind a load balancer. 6) Detection: alert on unexpected engine-core exits, token-placeholder mismatch errors in vLLM logs, and sudden health-check failures that correlate with multimodal requests. Review the GHSA-p92p-rxj5-7p2x advisory for further guidance.

Q: What systems are affected by CVE-2026-114050?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference, multimodal pipelines, RAG pipelines, agent frameworks.

Q: What is the CVSS score for CVE-2026-114050?

CVE-2026-114050 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.20%.

CISO Take

CVE-2026-114050 is a denial-of-service flaw in vLLM before 0.31.0: the server trusts a client-supplied multimodal UUID as a cache key without checking it on cache hits. An unauthenticated remote attacker can use this to desynchronize the engine's internal processor caches and trigger a fatal token-placeholder mismatch, which kills the whole serving instance until someone restarts it. It carries a CVSS of 7.5 (network, low complexity, no privileges, no user interaction). No public exploit, Nuclei template or KEV listing exists at the time of analysis, and EPSS data is not yet available, so there is no evidence of active exploitation. Because the attack needs only a crafted request to a reachable endpoint, any internet-exposed or multi-tenant vLLM deployment should treat it as a priority availability risk. Upgrade to vLLM 0.31.0 or later, and until then restrict multimodal inference endpoints to authenticated, trusted clients behind a gateway.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

High availability risk, no confidentiality or integrity impact. The attack is network-reachable, low complexity, and needs no authentication or user interaction, so a single crafted request can take down the serving process. Exposure is highest for vLLM instances reachable from the internet or shared across tenants that accept multimodal input with client-chosen UUIDs. Exploitation likelihood is unquantified (EPSS N/A), no public PoC or scanner template exists, and the CVE is not in CISA KEV, so current evidence suggests no active exploitation. The low skill needed to craft the request means that could change quickly once details circulate.

How does the attack unfold?

Initial Access

Attacker sends a request with a client-chosen multimodal UUID to an exposed vLLM inference endpoint, with no authentication required.

AML.T0049

Cache Desynchronization

A second request reuses the same UUID with different content, and the server accepts it as a cache hit without a consistency check, desynchronizing the P0/P1 processor caches.

AML.T0040

Impact

The token-placeholder mismatch triggers a fatal error that kills the engine, taking the whole serving instance offline until restart.

AML.T0029

Initial Access

Attacker sends a request with a client-chosen multimodal UUID to an exposed vLLM inference endpoint, with no authentication required.

AML.T0049

Cache Desynchronization

A second request reuses the same UUID with different content, and the server accepts it as a cache hit without a consistency check, desynchronizing the P0/P1 processor caches.

AML.T0040

Impact

The token-placeholder mismatch triggers a fatal error that kills the engine, taking the whole serving instance offline until restart.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	< 0.31.0	`0.31.0`
95.4K94 dependentsPushed 6d ago27% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade vLLM to 0.31.0 or later, which adds consistency checks on multimodal cache identity. 2) Until patched, put vLLM behind an authenticating API gateway and do not expose it directly to untrusted networks. 3) Where possible, strip or override client-supplied multimodal UUID fields at the gateway so the server generates its own identifiers. 4) Rate-limit and validate multimodal requests, and block repeated requests that reuse identical UUIDs with differing content. 5) Configure automatic restart and health checks (Kubernetes liveness probes or a process supervisor) to shorten outage windows, and run multiple replicas behind a load balancer. 6) Detection: alert on unexpected engine-core exits, token-placeholder mismatch errors in vLLM logs, and sudden health-check failures that correlate with multimodal requests. Review the GHSA-p92p-rxj5-7p2x advisory for further guidance.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSInferenceFrameworkAPIAML.T0029- Denial of AI Service AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to unknown risks and system failures

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-114050?

CVE-2026-114050 is a denial-of-service flaw in vLLM before 0.31.0: the server trusts a client-supplied multimodal UUID as a cache key without checking it on cache hits. An unauthenticated remote attacker can use this to desynchronize the engine's internal processor caches and trigger a fatal token-placeholder mismatch, which kills the whole serving instance until someone restarts it. It carries a CVSS of 7.5 (network, low complexity, no privileges, no user interaction). No public exploit, Nuclei template or KEV listing exists at the time of analysis, and EPSS data is not yet available, so there is no evidence of active exploitation. Because the attack needs only a crafted request to a reachable endpoint, any internet-exposed or multi-tenant vLLM deployment should treat it as a priority availability risk. Upgrade to vLLM 0.31.0 or later, and until then restrict multimodal inference endpoints to authenticated, trusted clients behind a gateway.

Is CVE-2026-114050 actively exploited?

No confirmed active exploitation of CVE-2026-114050 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-114050?

1) Upgrade vLLM to 0.31.0 or later, which adds consistency checks on multimodal cache identity. 2) Until patched, put vLLM behind an authenticating API gateway and do not expose it directly to untrusted networks. 3) Where possible, strip or override client-supplied multimodal UUID fields at the gateway so the server generates its own identifiers. 4) Rate-limit and validate multimodal requests, and block repeated requests that reuse identical UUIDs with differing content. 5) Configure automatic restart and health checks (Kubernetes liveness probes or a process supervisor) to shorten outage windows, and run multiple replicas behind a load balancer. 6) Detection: alert on unexpected engine-core exits, token-placeholder mismatch errors in vLLM logs, and sudden health-check failures that correlate with multimodal requests. Review the GHSA-p92p-rxj5-7p2x advisory for further guidance.

What systems are affected by CVE-2026-114050?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference, multimodal pipelines, RAG pipelines, agent frameworks.

What is the CVSS score for CVE-2026-114050?

CVE-2026-114050 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inferencemultimodal pipelinesRAG pipelinesagent frameworks

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.

Exploitation Scenario

An attacker finds a vLLM OpenAI-compatible endpoint serving a vision-language model that accepts multimodal inputs. They send one request with an image tagged with a chosen UUID, then a second request reusing that UUID with different content or a different number of placeholder tokens. The server treats the UUID as a valid cache hit without verifying that the content matches, so the processor caches fall out of sync. The mismatch between expected and actual token placeholders raises a fatal error that terminates the engine. The attacker repeats the request each time the service restarts, keeping the inference API unavailable.

Weaknesses (CWE)

CWE-345Insufficient Verification of Data AuthenticityPrimary CWE-345Insufficient Verification of Data AuthenticityPrimary CWE-345Insufficient Verification of Data Authenticity

CWE-345 — Insufficient Verification of Data Authenticity: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Source: MITRE CWE corpus.