CVE-2026-94626

A flaw was found in vLLM. A remote attacker can exploit a vulnerability in the kvtransferparams function on OpenAI-compatible completion endpoints by supplying an unvalidated tpsize parameter. This allows for unbounded memory allocation, leading to memory exhaustion and a kernel Out-Of-Memory OOM...

PYSEC-2026-4008

vLLM through 0.29.0 fails to validate the tpsize parameter in kvtransferparams on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tpsize values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel...