Evidence · DiggingBeagle record
vLLM advisory GHSA-rh6f-3x46-j33q: caller-controlled cache identities
October 6 GitHub advisory describes two separate sites with common insufficient shared-cache key binding: EXIF ImageID multimodal alias and untyped prefix-cache field collisions.
- Published
- Oct 6, 2026
- Publisher
- vLLM security advisory
- Source role
- primary disclosure
Evidence record
October 6 GitHub advisory describes two separate sites with common insufficient shared-cache key binding: EXIF ImageID multimodal alias and untyped prefix-cache field collisions.
Claim-level citations (3)
- supportsvLLM cross-request cache identity confusion via EXIF and LoRA salt: The advisory says a UUID-valued image EXIF ImageID can supersede content hashing so different images map to the same multimodal processor-cache entry.
Summary: Site A EXIF ImageID
- supportsvLLM cross-request cache identity confusion via EXIF and LoRA salt: The advisory says a first-block prefix-cache key can collide when a caller-controlled cache_salt string equals a static LoRA name, allowing first-block KV-state confusion across requests.
Summary: Site B untyped prefix-cache extra keys
- supportsvLLM cross-request cache identity confusion via EXIF and LoRA salt: The advisory lists affected versions below 0.31.0 and patched versions 0.31.0 or later for the described issue family.
Package, Affected versions, Patched versions