What happened
The Oct 20–21 NVD batch (seed) and aggregator coverage confirm vLLM fixed a wave of request-controlled failure modes in the multimodal path: cache desync killing whole serving instances, a validation-bypass that kills the EngineCore thread while the health check stays green (making the outage invisible to load balancers), unbounded processor-cache memory growth, cross-request mask leakage, cache aliasing, and uncontrolled processor resource consumption. Aggregator coverage also lists additional 0.32.0 fixes (pickle.loads via forged shared-memory cache handles; Ghostscript execution via EPS images).
Why it matters
These are unauthenticated availability/confidentiality breaks in the most common open LLM serving stack: a single request can take down a public endpoint, and shared multimodal caches can cross-deliver processed media between tenants on multi-tenant inference platforms.
Attack vector
Unauthenticated requests with attacker-controlled multimodal parameters: duplicate/colliding processor-cache identifiers (fatal token-placeholder mismatch), null max_tokens bypassing min<=max validation (kills EngineCore input thread while /health still returns 200), unbounded/diverse mel_config or image/patch/frame count values (memory exhaustion), and request-supplied cache salts for cache aliasing.
Affected systems
vLLM <0.31.0 — CVE-2026-114050 (cache-identity desync DoS, 7.5), CVE-2026-114051 (max_tokens validation bypass → EngineCore thread death, 7.5), CVE-2026-114052 (MOSS-Audio unbounded processor-cache memory exhaustion, 7.5), CVE-2026-114055 (mm_processor_kwargs resource exhaustion, 7.5), CVE-2026-114054 (cache aliasing via EXIF ImageID/cache_salt, 6.5), CVE-2026-114049 (cross-request mask leak, 3.7)
Mitigation
Upgrade to vLLM 0.31.0 (0.32.0 per aggregator coverage of the wider wave, including forged-SHM pickle deserialization and EPS/Ghostscript image handling); limit who can reach /inference and /invocations; validate/rate-limit multimodal processor parameters at a gateway.