Incident: A guessable hash that shared another prompt's cache

Module 11 · Incident file · About 40 minutes

What happened

On 6 February 2025 the vLLM project published security advisory GHSA-rm76-4mrf-v9r8, CVE-2025-25183: "vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cache" (advisory). Its summary: "Maliciously constructed prompts can lead to hash collisions, resulting in prefix cache reuse", which can interfere with later responses. A user, kexinoh, reported it; Russell Bryant coordinated.

The cause was one function. "vLLM's prefix caching makes use of Python's built-in hash() function", and since Python 3.12 hash(None) is a predictable constant. The advisory states the cost plainly: "The impact of a collision would be using cache that was generated using different content." It rated the issue Low (CVSS 2.6). Versions before 0.7.2 were affected.

The fix, pull request #12621 ("Improve hash collision avoidance in prefix caching", merged 4 February 2025), seeds the first block's hash with a value that changes on every run, "the behavior we got here prior to Python 3.12" (PR). The advisory notes that SHA-256 would reduce collisions further, at some cost. vLLM's design notes now say older versions' key "was not guaranteed to be collision-free" and that since v0.11 "the default hashing algorithm is sha256" (docs, read 13 October 2026).