8.7
Élevée
CVE-2026-93436 vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode…
Description
vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max_tokens=0 to exhaust decode-worker memory without bound until the worker restarts.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| vllm 0.29 | premières → 0.29.0 | Pas de correctif indiqué |
Autres CVE de vllm
Les 121 CVE de vllm →
CVE-2026-115918
vLLM is an inference and serving engine for large language models
6.5
Moyenne
CVE-2026-115917
vLLM is an inference and serving engine for large language models
3.4
Faible
CVE-2026-115916
vLLM is an inference and serving engine for large language models
6.5
Moyenne
CVE-2026-115915
vLLM is an inference and serving engine for large language models
8.1
Élevée