CVE-2026-100647: vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt
vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cachesalt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP requests with multi-hundred-megabyte salt values that trigger expensive pickle serialization and SHA-256 hashing, stalling the scheduler thread and denying service to all concurrent requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vLLMto a version that resolves this vulnerability.Fixed in 0.29.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated network client that can reach vLLM's OpenAI-compatible or Anthropic API endpoints can submit a request with an oversized cache_salt value. No privileges or user interaction are required.
What is the operational impact of exploitation?
A multi-hundred-megabyte cache_salt can force expensive pickle serialization and SHA-256 hashing on the single EngineCore scheduler thread. This stalls that thread and can deny service to all concurrent requests.
Are deployments using the affected API endpoints exposed by default?
The affected endpoints accept the cache_salt parameter without maximum-length validation in versions before 0.29.0. Exposure depends on whether unauthenticated clients can reach those OpenAI-compatible or Anthropic API endpoints.