vLLM: VLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on…
vLLM
More for vLLM RSS feed for vLLM
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Record
- CVE-2026-94626
- Affects
- vLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 21, 2026
- Source last modified
- September 29, 2026
Description
vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel OOM-kill of the decode worker process.
Description quoted from the NVD record.
Who is affected
vLLM is a program that runs AI language models on a server so other apps can send them requests. This flaw affects vLLM versions through 0.29.0, in the part that accepts text requests in the same style as OpenAI's service. It matters when vLLM is set up to split each request between two separate workers, one that prepares the request and one that writes the answer. An attacker can send a request with a bad setting that makes vLLM use unlimited memory, until the computer shuts down the worker that writes the answers. This stops the service from answering. This flaw is rated High.
What to do
- The person who installed or runs vLLM for your organization should check which version is in use and whether it is set up to split requests between separate workers as described above.
- No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release, and install it as soon as one is available.
- If an IT provider or vendor runs vLLM for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of September 29, 2026 and reviewed before publishing.