Insufficient verification of data authenticity in vLLM - CVE-2026-114050
Published: October 6, 2026 / Updated: October 23, 2026
Vulnerability identifier: #VU153335
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-114050
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to insufficient verification of data authenticity in the multimodal processor caches when handling multimodal requests with user-supplied UUIDs. A remote user can submit a crafted multimodal request with a reused UUID to cause a denial of service.
Successful exploitation requires the P0 sender cache to evict an item while the P1 receiver cache retains the corresponding stale item.
Affected software
vLLM
How to mitigate CVE-2026-114050
Install security update from vendor's website.
vLLM - update to 0.31.0