CVE-2026-94624

vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can supply arbitrary remote host and port values in kv_transfer_params to create unreachable peer sessions that retain ZeroMQ sockets until the context quota is exhausted, causing an uncaught ZMQError that crashes EngineCore and stops all inference.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/vllm-project/vllm	Product
https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/kv_offload/tiering/p2p/control/zmq.py#L240-L260	Product
https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/kv_offload/tiering/p2p/manager.py#L667-L677	Product
https://github.com/vllm-project/vllm/pull/51504	Issue Tracking Patch
https://www.vulncheck.com/advisories/vllm-through-0.29.0-denial-of-service-via-unbounded-p2p-kv-offloading-sessions	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*

History

29 Sep 2026, 12:47

Type	Values Removed	Values Added
CPE		cpe:2.3:a:vllm:vllm::::::::
First Time		Vllm vllm Vllm
References	~~() https://github.com/vllm-project/vllm -~~	() https://github.com/vllm-project/vllm - Product
References	~~() https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/kv_offload/tiering/p2p/control/zmq.py#L240-L260 -~~	() https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/kv_offload/tiering/p2p/control/zmq.py#L240-L260 - Product
References	~~() https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/kv_offload/tiering/p2p/manager.py#L667-L677 -~~	() https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/kv_offload/tiering/p2p/manager.py#L667-L677 - Product
References	~~() https://github.com/vllm-project/vllm/pull/51504 -~~	() https://github.com/vllm-project/vllm/pull/51504 - Issue Tracking, Patch
References	~~() https://www.vulncheck.com/advisories/vllm-through-0.29.0-denial-of-service-via-unbounded-p2p-kv-offloading-sessions -~~	() https://www.vulncheck.com/advisories/vllm-through-0.29.0-denial-of-service-via-unbounded-p2p-kv-offloading-sessions - Third Party Advisory

21 Sep 2026, 22:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-21 22:17

Updated : 2026-09-29 12:47

NVD link : CVE-2026-94624

Mitre link : CVE-2026-94624

CVE.ORG link : CVE-2026-94624

JSON object : View

Products Affected

vllm

vllm

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

7.5 /10