The defect lies in vLLM's mirrored multimodal IPC cache. When a multimodal request that references a media hash is rejected before the engine admits it, the frontend sender cache records the hash but the engine receiver cache never receives the payload. A later request that reuses the same hash forces the sender cache to transmit nothing while the receiver cache hit an assertion with the message "Expected a cached item", which causes the vLLM service to crash. This flaw manifests as a buffer consistency bug between caching components and is classified as CWE-617.

vLLM, the inference and serving engine for large language models released by vllm-project, is affected. All installations running any version prior to 0.28.0 are vulnerable; no other vendors or products are listed as impacted.

The CVSS score of 6.5 indicates moderate severity due to denial‑of‑service potential. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation to date. The likely attack vector is inferred to be the network interface of the vLLM service, requiring the ability to send crafted multimodal requests to the endpoint. An attacker can repeatedly send rejected requests that reuse the same media hash, eventually triggering the assertion and terminating the service, affecting all users sharing the instance.