SUSE CVE-2026-94622

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kvtransferparams dictionary entries to trigger an uncaught KeyError in EngineCore scheduling,...

SUSE CVE-2026-94623

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in...

CVE-2026-94622

A flaw was found in vLLM. A remote attacker can exploit this vulnerability by sending requests with incomplete kvtransferparams dictionary entries to the NIXL connector's metadata handling. This can trigger an uncaught error in the EngineCore scheduling, leading to the termination of the decode...

CVE-2026-94623

A flaw was found in vLLM. This denial of service vulnerability exists within the NIXL connector's prefix caching implementation. A remote attacker can exploit this by sending completion requests with multiple prompts of different lengths. This improper validation of block counts causes an asserti...

EUVD-2026-84216

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kvtransferparams dictionary entries to trigger an uncaught KeyError in EngineCore scheduling,...

EUVD-2026-84217

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in...

Improper Check or Handling of Exceptional Conditions

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Check or Handling of Exceptional Conditions via incomplete kvtransferparams dictionary entries in the NIXL connector's metadata handling fo...

CVE-2026-94623

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in...

PYSEC-2026-4005

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in...

PYSEC-2026-4005

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in...

CVE-2026-94622

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kvtransferparams dictionary entries to trigger an uncaught KeyError in EngineCore scheduling,...

PYSEC-2026-4004

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kvtransferparams dictionary entries to trigger an uncaught KeyError in EngineCore scheduling,...

PYSEC-2026-4004

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kvtransferparams dictionary entries to trigger an uncaught KeyError in EngineCore scheduling,...

CVE-2026-94623 vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in...

CVE-2026-94623

vLLM through version 0.29.0 is affected by a denial of service vulnerability in the NIXL connector's prefix caching implementation. The root cause is a failure to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. An unauthenticated...

CVE-2026-94622 vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kvtransferparams dictionary entries to trigger an uncaught KeyError in EngineCore scheduling,...

CVE-2026-94622 vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kvtransferparams dictionary entries to trigger an uncaught KeyError in EngineCore scheduling,...

CVE-2026-94622 vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kvtransferparams dictionary entries to trigger an uncaught KeyError in EngineCore scheduling,...

CVE-2026-94622

vLLM versions through 0.29.0 are affected by a denial of service vulnerability in the NIXL connector's metadata handling, specifically affecting prefill/decode disaggregated deployments. An unauthenticated, remote attacker can send requests with incomplete kv_transfer_params dictionary entries to...

PT-2026-96313

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.1 Description A denial of service issue exists in the NIXL connector's prefix caching implementation within prefill/decode disaggregated deployments. The system fails to properly validate block counts when processin...