8.7
Élevée
CVE-2026-94622 vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for…
Description
vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kv_transfer_params dictionary entries to trigger an uncaught KeyError in EngineCore scheduling, causing the decode engine to terminate and making all routed requests fail until manual restart.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| vllm 0.29 | premières → 0.29.0 | Pas de correctif indiqué |
Références
- Pull Request #54807 github.com
- github.com github.com
- github.com github.com
- VulnCheck Advisory: vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata www.vulncheck.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de vllm
Les 121 CVE de vllm →
CVE-2026-115918
vLLM is an inference and serving engine for large language models
6.5
Moyenne
CVE-2026-115917
vLLM is an inference and serving engine for large language models
3.4
Faible
CVE-2026-115916
vLLM is an inference and serving engine for large language models
6.5
Moyenne
CVE-2026-115915
vLLM is an inference and serving engine for large language models
8.1
Élevée