CVE-2026-94625

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-94625
vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 480 seconds while health checks continue returning success.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/vllm-project/vllm Product
https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/mooncake/mooncake_connector.py#L1234-L1242 Product
https://github.com/vllm-project/vllm/pull/51236 Issue Tracking Patch
https://www.vulncheck.com/advisories/vllm-through-0.29.0-resource-exhaustion-via-ownerless-mooncake-transfer-placeholders Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*
History

29 Sep 2026, 12:47

Type Values Removed Values Added
CPE cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*
First Time Vllm vllm
Vllm
References () https://github.com/vllm-project/vllm - () https://github.com/vllm-project/vllm - Product
References () https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/mooncake/mooncake_connector.py#L1234-L1242 - () https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/mooncake/mooncake_connector.py#L1234-L1242 - Product
References () https://github.com/vllm-project/vllm/pull/51236 - () https://github.com/vllm-project/vllm/pull/51236 - Issue Tracking, Patch
References () https://www.vulncheck.com/advisories/vllm-through-0.29.0-resource-exhaustion-via-ownerless-mooncake-transfer-placeholders - () https://www.vulncheck.com/advisories/vllm-through-0.29.0-resource-exhaustion-via-ownerless-mooncake-transfer-placeholders - Third Party Advisory

21 Sep 2026, 22:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-09-21 22:17

Updated : 2026-09-29 12:47

NVD link : CVE-2026-94625

Mitre link : CVE-2026-94625

CVE.ORG link : CVE-2026-94625

JSON object : View

Products Affected

vllm

  • vllm
CWE
CWE-772

Missing Release of Resource after Effective Lifetime