CVE-2026-94626

🗓️ 21 Sep 2026 22:04:15Reported by VulnCheckType

vLLM through 0.29.0 unvalidated tp_size in kv_transfer_params allows memory exhaustion and OOM-kill.

Reporter	Title	Published	Views	Family All 4
Circl	CVE-2026-94626	21 Sep 202623:03	–	circl
Cvelist	CVE-2026-94626 vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size	21 Sep 202622:04	–	cvelist
EUVD	EUVD-2026-84220	22 Sep 202600:30	–	euvd
NVD	CVE-2026-94626	21 Sep 202622:17	–	nvd

Vulners

CNA

Node

vllm-project vllmRange0–0.29.0

[
  {
    "vendor": "vllm-project",
    "product": "vllm",
    "defaultStatus": "unaffected",
    "packageURL": "pkg:pypi/vllm",
    "versions": [
      {
        "version": "0",
        "lessThanOrEqual": "0.29.0",
        "status": "affected",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/utils.py
github	www.github.com/vllm-project/vllm/pull/51137
vulncheck	www.vulncheck.com/advisories/vllm-through-0.29.0-memory-exhaustion-via-unvalidated-nixl-tp-size
github	www.github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/nixl/metadata.py
github	www.github.com/vllm-project/vllm

21 Sep 2026 22:17Current

CVSS 3.17.5

CVSS 48.7

CWE-789