10 matches found
CVE-2026-94622
A flaw was found in vLLM. A remote attacker can exploit this vulnerability by sending requests with incomplete kvtransferparams dictionary entries to the NIXL connector's metadata handling. This can trigger an uncaught error in the EngineCore scheduling, leading to the termination of the decode...
CVE-2026-94623
A flaw was found in vLLM. This denial of service vulnerability exists within the NIXL connector's prefix caching implementation. A remote attacker can exploit this by sending completion requests with multiple prompts of different lengths. This improper validation of block counts causes an asserti...
EUVD-2026-84216
vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kvtransferparams dictionary entries to trigger an uncaught KeyError in EngineCore scheduling,...
CVE-2026-94623
vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in...
CVE-2026-94622
vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kvtransferparams dictionary entries to trigger an uncaught KeyError in EngineCore scheduling,...
CVE-2026-94623 vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure
vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in...
CVE-2026-94623
vLLM through version 0.29.0 is affected by a denial of service vulnerability in the NIXL connector's prefix caching implementation. The root cause is a failure to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. An unauthenticated...
CVE-2026-94622 vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata
vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kvtransferparams dictionary entries to trigger an uncaught KeyError in EngineCore scheduling,...
CVE-2026-94622
vLLM versions through 0.29.0 are affected by a denial of service vulnerability in the NIXL connector's metadata handling, specifically affecting prefill/decode disaggregated deployments. An unauthenticated, remote attacker can send requests with incomplete kv_transfer_params dictionary entries to...
CVE-2026-94622 vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata
vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kvtransferparams dictionary entries to trigger an uncaught KeyError in EngineCore scheduling,...