CVE-2026-94622 — vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata
vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send…
Published: 2026-09-21 · CVSS: 8.7 · CVSS 4.0
vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kv_transfer_params dictionary entries to trigger an uncaught KeyError in EngineCore scheduling, causing the decode engine to terminate and making all routed requests fail until manual restart.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7