vLLM: VLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where…
vLLM
More for vLLM RSS feed for vLLM
- Severity
- Medium, CVSS 5.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Record
- CVE-2026-94625
- Affects
- vLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 21, 2026
- Source last modified
- September 29, 2026
Description
vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 480 seconds while health checks continue returning success.
Description quoted from the NVD record.