PYSEC-2026-4004

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kvtransferparams dictionary entries to trigger an uncaught KeyError in EngineCore scheduling,...

PT-2026-96312

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.1 Description A denial of service issue exists in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. An attacker can send requests containing incomplete kv transfer params dictionar...