Reachable assertion in vLLM - CVE-2026-105753
Published: November 9, 2026
Vulnerability identifier: #VU162991
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-105753
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged remote attacker to deny service by causing subsequent multimodal requests to fail in vLLM.
The vulnerability exists due to desynchronization of mirrored multimodal caches under the default LRU configuration when a request is rejected after rendering but before reaching the engine core. A low-privileged remote attacker can submit an oversized prompt containing media, then reuse the same media hash in another request to trigger a receiver assertion and fail that request.
Affected software
vLLM
How to mitigate CVE-2026-105753
Install security update from vendor's website.
vLLM - update to 0.28.0