PyPI/vllm CVE-2026-105752: low 3.1, EPSS 0.22%

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

Action: Upgrade vllm to 0.30.0 or later.

pip install vllm==0.30.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-4308
• https://github.com/vllm-project/vllm/security/advisories/GHSA-935w-9g4m-p28p
• https://github.com/vllm-project/vllm/pull/50195
• https://github.com/vllm-project/vllm/pull/51818
• https://github.com/vllm-project/vllm/commit/6a2a2bb02b563b83f946012959fd3927984d072a
• https://github.com/vllm-project/vllm
• https://github.com/vllm-project/vllm/releases/tag/v0.30.0
• https://pypi.org/project/vllm
• https://github.com/advisories/GHSA-935w-9g4m-p28p
• https://nvd.nist.gov/vuln/detail/CVE-2026-105752

CVE-2026-105752 · published 2026-10-15T10:22:46.407337Z · modified 2026-10-15T14:45:14.136002872Z · JSON