CVE-2026-105756
Reported by github_m · Published October 5, 2026
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| tritonserver-backend-vllm-cuda-13.0 | Chainguard | 25.11-r17 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| vllm-project | vllm | < 0.30.0 |
| chainguard | tritonserver-backend-vllm-cuda-13.0 | 0 |
| vllm-project | vllm | 0 |
| chainguard | vllm-openai-cuda-13.0 | 0 |
| chainguard | py3-vllm-cuda-12.4 | * |
| chainguard | lmcache-cuda-12.8 | * |
| PyPI | vllm | 0 |
| chainguard | vllm-cuda-13.2 | 0 |
Timeline
- Oct 5, 2026 CVE Published
- Oct 6, 2026 EPSS Score (11 in total, the first dated here)
- Oct 6, 2026 Coalition ESS Score
- Oct 6, 2026 CVE Updated
- Oct 31, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-105756
vulnetix vdb fixes CVE-2026-105756Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-105756/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/vllm-project/vllm/security/advisories/GHSA-2823-qmq8-rwvj x_refsource_CONFIRM
- https://github.com/vllm-project/vllm/pull/51444 x_refsource_MISC
- https://github.com/vllm-project/vllm/commit/e962733e08d10f7ca65dac4df99e116460b8b174 x_refsource_MISC
- https://github.com/vllm-project/vllm/releases/tag/v0.30.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-105756 advisory
- https://github.com/advisories/GHSA-2823-qmq8-rwvj advisory