https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 03:47:01 +0000 https://vulnerability.circl.lu/vuln/cve-2026-105755 <p><strong>Affected:</strong> vllm-project vllm</p> <p>vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker&#39;s query_key value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim&#39;s identifier can overwrite the cached query embedding so the victim&#39;s documents are scored against the attacker&#39;s query, and shared use counters can also cause a late-interaction cache-miss error. This issue is fixed in version 0.30.0.</p> <p><strong>Affected:</strong> vllm-project vllm</p> <p>vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker&#39;s query_key value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim&#39;s identifier can overwrite the cached query embedding so the victim&#39;s documents are scored against the attacker&#39;s query, and shared use counters can also cause a late-interaction cache-miss error. This issue is fixed in version 0.30.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-105755