6.9
Medium
CVE-2026-94625 vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests…
Description
vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 480 seconds while health checks continue returning success.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| vllm 0.29 | earliest → 0.29.0 | No fix stated |
References
- Pull Request #51236 github.com
- github.com github.com
- github.com github.com
- VulnCheck Advisory: vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of vllm
The 121 CVEs of vllm →
CVE-2026-115918
vLLM is an inference and serving engine for large language models
6.5
Medium
CVE-2026-115917
vLLM is an inference and serving engine for large language models
3.4
Low
CVE-2026-115916
vLLM is an inference and serving engine for large language models
6.5
Medium
CVE-2026-115915
vLLM is an inference and serving engine for large language models
8.1
High