CyberRota Analysis
AI-GeneratedThe vulnerability affects the vLLM inference and serving engine for large language models, specifically prior to version 0.28.0, where a flaw in the default mirrored multimodal LRU cache can lead to service availability failures. When a request with a reused media hash is rejected, it results in the absence of a payload being sent, causing the system to assert an error and disrupt service. Organizations utilizing vLLM for multimodal rendering should prioritize upgrading to version 0.28.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if that request is rejected. A later request reusing the same media hash causes MultiModalProcessorSenderCache to send no payload and MultiModalReceiverCache to reach an assertion with the message "Expected a cached item," producing a shared-service availability failure. This issue is fixed in version 0.28.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)