CVE-2026-105756
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
CVSS Skor
6.5
EPSS İhtimal
%0.3
Risk Skoru
0.0
Yayın
14 gün önce
İlgili Siber Güvenlik Haberleri (Newsroom)
Bu zafiyetin basında ve siber güvenlik yayın organlarında yer aldığı makaleler ve analiz bültenleri:
Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely
A critical vulnerability in LMCache, open-source software that speeds up large language model (LLM) servers such as vLLM, lets an attacker run code on the cache server without logging in, and no fixed version is available. The flaw is in LMCache's multiprocess mode, where the cache runs as a standalone server that LLM workers reach over the ZeroMQ messaging library. A single network
İlgili Benzer Açıklar
9.3
9.8
9.8
CVE-2026-42208 Aktif sömürülüyorSQL injection in Litellm
Yama doğrulandı Public Exploits:6EPSS %6
10.0
9.8
CVE-2026-111058Mercury: Unauthenticated Remote Code Execution via /api/kernels
Yama durumu bilinmiyor
6.5
CVE-2026-48710 Aktif sömürülüyorStarlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Yama doğrulandı Public Exploits:4EPSS %7
Bu açığı API ile alın
Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-105756"