CVE-2026-105755 | vllm-project vLLM up to 29.x Flash Late-Interaction Scoring X-Request-Id race condition

October 6, 2026 Yanac

A vulnerability described as problematic has been identified in vllm-project vLLM up to 29.x. Affected is an unknown function of the component Flash Late-Interaction Scoring. Such manipulation of the argument X-Request-Id leads to race condition.

This vulnerability is uniquely identified as CVE-2026-105755. The attack can be launched remotely. No exploit exists.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More