CVE-2026-94627

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-94627
vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts, causing orphaned KV cache blocks to accumulate until process restart and eventually preventing legitimate requests from executing.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/vllm-project/vllm Product
https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/mooncake/mooncake_connector.py#L1978-L1989 Product
https://github.com/vllm-project/vllm/pull/49796 Issue Tracking Patch
https://www.vulncheck.com/advisories/vllm-through-0.29.0-gpu-kv-cache-leak-via-mooncake-transfer-id-collision Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*
History

29 Sep 2026, 12:46

Type Values Removed Values Added
CPE cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*
First Time Vllm vllm
Vllm
References () https://github.com/vllm-project/vllm - () https://github.com/vllm-project/vllm - Product
References () https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/mooncake/mooncake_connector.py#L1978-L1989 - () https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/mooncake/mooncake_connector.py#L1978-L1989 - Product
References () https://github.com/vllm-project/vllm/pull/49796 - () https://github.com/vllm-project/vllm/pull/49796 - Issue Tracking, Patch
References () https://www.vulncheck.com/advisories/vllm-through-0.29.0-gpu-kv-cache-leak-via-mooncake-transfer-id-collision - () https://www.vulncheck.com/advisories/vllm-through-0.29.0-gpu-kv-cache-leak-via-mooncake-transfer-id-collision - Third Party Advisory

21 Sep 2026, 22:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-09-21 22:17

Updated : 2026-09-29 12:46

NVD link : CVE-2026-94627

Mitre link : CVE-2026-94627

CVE.ORG link : CVE-2026-94627

JSON object : View

Products Affected

vllm

  • vllm
CWE
CWE-401

Missing Release of Memory after Effective Lifetime