A flaw was found in vLLM. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending HTTP requests containing an excessively large cache_salt parameter to exposed API endpoints. Because this input lacks maximum length validation, processing the oversized data consumes excessive CPU resources on the core scheduler thread. This stalling prevents legitimate requests from being processed, resulting in high latency or complete service unavailability for concurrent users.
Last checked: 2026-10-06 21:17 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-28 18:26 UTC)
Fix evidence last checked: 2026-10-06 23:39 UTC