CVE-2026-94625 — vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders
vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never recla…
Published: 2026-09-21 · CVSS: 6.9 · CVSS 4.0
vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 480 seconds while health checks continue returning success.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7