CVE-2026-105756: 
NixOS vulnerability analysis and mitigation

CVE-2026-105756 is a denial-of-service vulnerability in vLLM, an inference and serving engine for large language models, caused by loose cache_salt input validation that allows a single authenticated request to crash the EngineCore process on LMCache-MP deployments. Affected versions are all vLLM releases prior to 0.30.0 (confirmed on v0.25.1). The vulnerability was discovered by the "Patch the Planet" initiative (Trail of Bits + OpenAI collaboration, using GPT-5.5-Cyber), published to the GitHub Advisory Database on October 5, 2026, and assigned CVSS v3.1 base score of 6.5 (Medium) (Github Advisory).

The root cause is a mismatch between vLLM's loose cache_salt input validation (CWE-20: Improper Input Validation) and the stricter rules enforced by the downstream LMCache library, combined with an uncaught exception propagation path (CWE-248: Uncaught Exception). vLLM's OpenAI-compatible request models (Completions, Chat Completions, Responses, Pooling, and scale-out GenerateRequest) accept any non-empty string as cache_salt, but the LMCache library's IPCCacheServerKey.__post_init__ rejects salts containing @, /, \, or NUL bytes, or values exceeding 128 characters, by raising a ValueError. This ValueError propagates uncaught through Scheduler.schedule() into EngineCore's top-level exception handler (run_engine_core), which treats any uncaught exception as fatal — logging "EngineCore encountered a fatal error.", calling _send_engine_dead(), and re-raising, thereby terminating the entire engine process. A minimal exploit payload is a single HTTP request with cache_salt: "/" (Github Advisory, vLLM PR #51444).

Exploitation results in a complete availability loss for the affected vLLM deployment: the EngineCore process terminates, causing all concurrent HTTP inference requests to fail and the /health endpoint to stop responding, effectively denying service to all users of that server. The impact is limited to availability — there is no confidentiality or integrity impact. The vulnerability only affects deployments where the LMCache-MP KV connector is explicitly enabled (requiring lmcache >= 0.4.4); other cache backends do not follow this failure path (Github Advisory).

No public proof-of-concept exploit code has been reported, and there is no evidence of in-the-wild exploitation at the time of disclosure (Github Advisory). The vulnerability requires low privileges (an authenticated API user) but no special configuration beyond the target deployment using LMCache-MP. The EPSS score is approximately 0.31% (22nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

1. Identify target: Locate a publicly reachable vLLM API endpoint (version < 0.30.0) configured with the LMCache-MP KV connector (lmcache >= 0.4.4 enabled as an opt-in connector).
2. Obtain credentials: Acquire any valid API key or authentication token for the vLLM OpenAI-compatible API (low-privilege access is sufficient).
3. Craft malicious request: Construct an OpenAI-compatible completion, chat completion, or responses API request that includes a cache_salt field containing a forbidden character. The minimal payload is:

   {"prompt": "hello", "max_tokens": 1, "cache_salt": "/"}

4. Send the request: Submit the crafted request to the vLLM API endpoint (e.g., POST /v1/completions). The value "/" passes vLLM's loose non-empty-string check but is rejected by LMCache's IPCCacheServerKey.__post_init__ with a ValueError.
5. Trigger engine crash: The ValueError propagates uncaught through Scheduler.schedule() into run_engine_core's generic exception handler, which marks the engine dead and terminates the EngineCore process, denying service to all concurrent users (Github Advisory, vLLM PR #51444).

• Logs: vLLM engine logs containing "EngineCore encountered a fatal error." immediately following a scheduler cache lookup, particularly with a ValueError traceback originating from lmcache/v1/multiprocess/custom_types.py (IPCCacheServerKey.__post_init__).
• Logs: API access logs showing a POST request to /v1/completions, /v1/chat/completions, or /v1/responses with a cache_salt parameter containing @, /, \, a NUL byte, or a value exceeding 128 characters, shortly before engine failure.
• Network: The vLLM /health endpoint returning errors or timing out after a suspicious request, indicating EngineCore has terminated.
• Process: Unexpected termination of the vLLM EngineCore process (vllm or python process) without a graceful shutdown signal.

Upgrade vLLM to version 0.30.0 or later, which introduces a shared validate_cache_salt() helper that enforces LMCache-compatible rules (rejecting @, /, \, NUL, and values over 128 characters) at the HTTP boundary across all five affected request models before scheduling (Github Advisory, vLLM v0.30.0 Release). For deployments that cannot upgrade immediately, implement network-level or API gateway input validation to reject requests containing forbidden characters in the cache_salt field, or restrict API access to trusted users only. Disabling the LMCache-MP KV connector eliminates the vulnerable code path entirely, as other cache backends are not affected.

The vulnerability was discovered through the "Patch the Planet" initiative, a collaboration between Trail of Bits and OpenAI using GPT-5.5-Cyber for AI-assisted security research, highlighting the growing role of AI in vulnerability discovery (Github Advisory). Coverage appeared in The Hacker News and several security news outlets, with some headlines inaccurately characterizing the issue as an unauthenticated RCE — a mischaracterization, as the actual impact is authenticated denial of service with no code execution (Github Advisory). Red Hat tracked the issue via Bugzilla and published a CVE advisory. The fix was reviewed and merged by vLLM maintainers within approximately one month of the initial PR submission.