vLLM EngineCore DoS via uncaught ValueError in LMCache-MP cache_salt validation

Vulnerability Overview Vulnerability Name: Loose validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream denial of service Vulnerability Description: Severity: Medium CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5) CWE: CWE-240 (Unhandled Exception) Affected Versions: vLLM >= 0.25.1 (Confirmed present in version 0.25.1, commit 7f2a3d04485) Patched Versions: >= 30.0.0 Vulnerability Details: vLLM's OpenAI-compatible request models (Completions, Chat Completions, Responses) accept the field provided by the client, validating only that it is a non-empty string, with no restrictions on characters or length. When the built-in LMCache-MP KV connector is enabled, this value is stored as-is in the request tracker and passed as a keyword argument to the scheduler's step-wise cache lookup. The downstream LMCache library applies stricter checks ( ), raising a if contains , , , or , or if its length exceeds 128 characters. Because vLLM's input validation is looser than that of the downstream consumer, and this gap is never translated into a request-scoped failure, the is uncaught in EngineCore's top-level handler, treated as a fatal error, and terminates the entire engine process. Impact Scope Availability: is an attacker-controlled, publicly accessible request field, and vLLM's validation is too permissive. A value like passes vLLM's check, reaches the downstream stricter validator, and raises a . This error is not converted into a request-scoped failure; instead, it causes the EngineCore process to terminate, resulting in a Denial of Service that affects all concurrent requests (HTTP fails, followed by failing). Applicability: The built-in LMCache-MP KV connector must be enabled ( >= 0.4.4), which is an optional KV connector boundary. In such deployments, no additional special configuration is required. The crash is a resource availability failure rather than expected optional feature behavior. Remediation Suggested Remediation: 1. Strict Admission Control: Add a shared helper function (e.g., in ) to match and reject downstream rules (rejecting , , , , and salts longer than 128 characters). Route this validation for every request field exposing across all request models: the three validators, the pooled base requests, and the non-pooled for token-to-text (which currently lacks validation). 2. Defense in Depth: Wrap the LMCache-MP lookup call from to ensure that downstream validator s become request-scoped failures rather than fatal EngineCore exceptions. This fix also covers future divergence in salt rules between vLLM and LMCache (failed request salt; fallback to cold lookup), which is a maintenance design decision. Core Fix Code: Patch: The patch implements Fix 1, covering all five request models, with regression tests covering rejected , 129-character, and accepted salt shapes for v0.25.1, without fuzzy testing. Credits: Reporter: Patch the Planet (Collaboration with Bits + OpenAI) Discovery Tool: GPT-5.5-Cyber (As part of the Patch the Planet security initiative) Proposed Fix: The proposed fix for this issue is available in the public pull request: #51444

Goal Reached Thanks to every supporter — we hit 100%!

vLLM EngineCore DoS via uncaught ValueError in LMCache-MP cache_salt validation

More from this source