vLLM: VLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership…
vLLM
More for vLLM RSS feed for vLLM
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Record
- CVE-2026-94627
- Affects
- vLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 21, 2026
- Source last modified
- September 29, 2026
Description
vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts, causing orphaned KV cache blocks to accumulate until process restart and eventually preventing legitimate requests from executing.
Description quoted from the NVD record.
Who is affected
vLLM is a server program that runs AI language models and answers requests sent to them. This flaw affects versions through 0.29.0 that use the Mooncake connector, a part that passes the model's working memory between servers. It applies only to setups where reading the prompt and writing the reply are split across separate servers. An attacker can send requests that contain several prompts at once. This leaves unused memory on the graphics cards, and that memory builds up until the program restarts. Eventually real requests can no longer run. This flaw is rated High.
What to do
- If someone on your staff installed and runs vLLM, they should act on this flaw. If an IT provider or vendor runs it for your organization, send them this advisory and ask when the update will be done.
- Find out which version of vLLM you run and whether it uses the Mooncake connector with prompt reading and reply writing on separate servers. Versions through
0.29.0set up this way are affected. - No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release and install it once it is available.
Analysis written from the source record as of September 29, 2026 and reviewed before publishing.