CVE-2026-105754

A MODERATE severity flaw was found in vLLM, the LLM inference and serving engine shipped in Red Hat AI Inference Server and Red Hat OpenShift AI. In the disaggregated scale-out path, the /inference/v1/generate endpoint accepts caller-supplied multimodal parameters, including tensors in the features.kwargs_data field, cache identifiers in the features.mm_hashes field, placeholder ranges in the features.mm_placeholders field, and wire-selected multimodal field processors, without validating or rebinding them to the active model's renderer contract. An authenticated remote attacker can submit crafted feature data, such as forged grid geometry, field types, or non-positive placeholder lengths, which can terminate the shared EngineCore process and cause a denial of service of the inference service. If an attacker knows or can induce a victim's content hash, forged cache hashes can also poison or retrieve cross-request encoder-cache state. Red Hat rates the impact as MODERATE with a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), matching the upstream assessment. Because this issue is of moderate impact with a CVSS score below 7.0, fixes for the affected Red Hat AI Inference Server and Red Hat OpenShift AI releases are deferred; the residual risk is that an authenticated remote attacker can crash the shared inference engine and disrupt service for all users, or manipulate shared multimodal encoder-cache state across requests.