CVE-2026-94625

A flaw was found in vLLM. A remote attacker can exploit this vulnerability by sending rejected prefill requests to the MooncakeConnector. This action creates ownerless transfer placeholders that are not properly reclaimed, leading to resource exhaustion. Consequently, legitimate requests may...

CVE-2026-94625 vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 4...

CVE-2026-94625 vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 4...