Medium severity5.3NVD Advisory· Published Sep 21, 2026· Updated Sep 29, 2026
CVE-2026-94625
CVE-2026-94625
Description
vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 480 seconds while health checks continue returning success.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
3- github.com/vllm-project/vllm/pull/51236nvdIssue TrackingPatch
- www.vulncheck.com/advisories/vllm-through-0.29.0-resource-exhaustion-via-ownerless-mooncake-transfer-placeholdersnvdThird Party Advisory
- github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/mooncake/mooncake_connector.pynvdProduct
News mentions
1- VLLM: Batch of 17 Vulnerabilities Disclosed, Affecting LLM Inference Engine StabilityVypr Intelligence · Sep 21, 2026