CVE-2026-94626

A flaw was found in vLLM. A remote attacker can exploit a vulnerability in the kvtransferparams function on OpenAI-compatible completion endpoints by supplying an unvalidated tpsize parameter. This allows for unbounded memory allocation, leading to memory exhaustion and a kernel Out-Of-Memory OOM...