CVE-2026-114050: vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

Multimodal content parts (image_url, video_url, input_audio, …) accept a user-supplied uuid field that vLLM uses verbatim as the item’s cache identity (mm_hash). The two frontend/engine processor caches (P0 “sender” cache in the API process, P1 “receiver” cache in the EngineCore process) are independent LRU caches whose evictions are not synchronized, and the P1 hit path performs zero consistency validation — it silently substitutes the cached item’s tensor data for whatever the current request actually contains.

A single unauthenticated client can exploit this to kill the entire engine, deterministically, with default server flags:

1. Seed: send a small image with uuid="U". Both caches now map U to an item with N_A visual tokens (e.g. 4).
2. Drift: send ~70 requests, each carrying a unique uuid, a max-size image, and an over-long text prompt. Each request is rejected with 400 — but after its image has been inserted into the P0 cache (insertion happens during chat rendering, before prompt-length validation), so these requests fill P0 without ever reaching the engine/P1. U is evicted from P0 only.
3. Kill: send a large image with uuid="U". P0 misses → the image is freshly processed and the prompt is spliced with N_B (e.g. 2048+) placeholder tokens; the request carries full data to the engine, but P1 still has U → the engine discards the fresh data and substitutes the stale N_A-row tensor. The scheduler plans for N_B encoder slots while the worker merges N_A embeddings into N_B placeholders → ValueError: Attempted to assign 4 = 4 multimodal tokens to 2048 placeholders at vllm/model_executor/models/utils.py:711 → uncaught in the EngineCore busy loop → _send_engine_dead() → the EngineCore process dies, every API server reports EngineDeadError and shuts down. /health never recovers; the deployment needs a full restart.

Verified end-to-end on the official vllm/vllm-openai:v0.29.0 image with Qwen2.5-VL-3B-Instruct, default configuration (no flags beyond --served-model-name/--gpu-memory-utilization): after 70 flood requests the kill request returned 500 EngineCore encountered an issue and /health went dead permanently. The vulnerable code is byte-identical on main (post-0.29.0).