CVE-2026-94625

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 4...

CVE-2026-94625

vLLM through 0.29.0 is affected by a resource exhaustion vulnerability in its MooncakeConnector component (used for KV-cache transfer). Rejected prefill requests create ownerless transfer placeholders that are never reclaimed, allowing a remote, unauthenticated attacker to exhaust sender task poo...