[Bugfix] Bound cache_salt length to prevent DoS via scheduler CPU exhaustion (#54353)
Signed-off-by: jperezde <jperezde@redhat.com>
Juan Pérez de Algaba committed
Aug 30, 2026 at 06:28 UTC
1dc464d42681d22f38caf1fdc1eb632dc4421c45
6 files changed
+7
vllm/entrypoints/anthropic/protocol.py
+1
@@ -141,6 +141,7 @@ class AnthropicMessagesRequest(BaseModel):
141
cache_salt: str | None = Field(
142
default=None,
143
min_length=1,
144
+ max_length=1024,
145
description=(
146
"If specified, the prefix cache will be salted with the provided "
147
"string to prevent an attacker to guess prompts in multi-user "
vllm/entrypoints/openai/chat_completion/protocol.py
+1
@@ -467,6 +467,7 @@ class ChatCompletionRequest(OpenAIBaseModel):
467
cache_salt: str | None = Field(
468
default=None,
469
min_length=1,
470
+ max_length=1024,
471
description=(
472
"If specified, the prefix cache will be salted with the provided "
473
"string to prevent an attacker to guess prompts in multi-user "
vllm/entrypoints/openai/completion/protocol.py
+1
@@ -199,6 +199,7 @@ class CompletionRequest(OpenAIBaseModel):
199
cache_salt: str | None = Field(
200
default=None,
201
min_length=1,
202
+ max_length=1024,
203
description=(
204
"If specified, the prefix cache will be salted with the provided "
205
"string to prevent an attacker to guess prompts in multi-user "
vllm/entrypoints/openai/responses/protocol.py
+1
@@ -252,6 +252,7 @@ class ResponsesRequest(OpenAIBaseModel):
252
cache_salt: str | None = Field(
253
default=None,
254
min_length=1,
255
+ max_length=1024,
256
description=(
257
"If specified, the prefix cache will be salted with the provided "
258
"string to prevent an attacker to guess prompts in multi-user "
vllm/entrypoints/pooling/base/protocol.py
+2
@@ -82,6 +82,8 @@ class PoolingBasicRequestMixin(OpenAIBaseModel):
82
)
83
cache_salt: str | None = Field(
84
default=None,
85
+ min_length=1,
86
+ max_length=1024,
87
description=(
88
"If specified, the prefix cache will be salted with the provided "
89
"string to prevent an attacker to guess prompts in multi-user "
vllm/entrypoints/scale_out/token_in_token_out/protocol.py
+1
@@ -124,6 +124,7 @@ class GenerateRequest(BaseModel):
124
cache_salt: str | None = Field(
125
default=None,
126
min_length=1,
127
+ max_length=1024,
128
description=(
129
"If specified, the prefix cache will be salted with the provided "
130
"string to prevent an attacker to guess prompts in multi-user "