WS-2026-0166

vllm 0.9.2 - 0.23.0: P2pNcclConnector parses a host:port from the client-controlled X-Request-Id header and connects to it over ZMQ/NCCL, letting an API caller exfiltrate KV-cache tensors to an attacker host GHSA-vfp2-c8pq-v6h6...