What’s Vulnerable › Vulnerabilities

CVE-2026-94625: vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-21 · updated 2026-09-29
• Weakness: CWE-772

Description

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 480 seconds while health checks continue returning success.

Affected products

• vllm-project vllm: through 0.29.0

References

• https://github.com/vllm-project/vllm
• https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/mooncake/mooncake_connector.py#L1234-L1242
• https://github.com/vllm-project/vllm/pull/51236
• https://www.vulncheck.com/advisories/vllm-through-0.29.0-resource-exhaustion-via-ownerless-mooncake-transfer-placeholders

Get alerted when CVE-2026-94625 or the next vulnerability affects your stack