CVE-2026-105755

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.30.0

Description In deployments using flash late-interaction scoring, the engine derives worker cache keys for query embeddings from the X-Request-Id header, which is controlled by the caller. A concurrent request that reuses a victim's identifier can overwrite the cached query embedding, causing the victim's documents to be scored against the attacker's query. Additionally, shared use counters may lead to a late-interaction cache-miss error. This issue affects the /score and /rerank endpoints.

Recommendations Update vLLM to version 0.30.0 or later. As a temporary mitigation, restrict or sanitize the X-Request-Id header to prevent users from providing arbitrary values.