8.7
Élevée
CVE-2026-94626 vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion…
Description
vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel OOM-kill of the decode worker process.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| vllm 0.29 | premières → 0.29.0 | Pas de correctif indiqué |
Références
- Pull Request #51137 github.com
- github.com github.com
- github.com github.com
- github.com github.com
- VulnCheck Advisory: vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size www.vulncheck.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de vllm
Les 121 CVE de vllm →
CVE-2026-115918
vLLM is an inference and serving engine for large language models
6.5
Moyenne
CVE-2026-115917
vLLM is an inference and serving engine for large language models
3.4
Faible
CVE-2026-115916
vLLM is an inference and serving engine for large language models
6.5
Moyenne
CVE-2026-115915
vLLM is an inference and serving engine for large language models
8.1
Élevée