CVE-2026-94624

Summary

The vulnerability allows attackers to cause a denial of service by configuring vLLM with specific P2P KV offloading settings that create unreachable peer sessions, leading to ZeroMQ socket exhaustion and EngineCore crashes. This affects inference services that use the affected offloading features.

Exploitability

Exploitation is relatively straightforward as it requires only configuring the OffloadingConnector with arbitrary remote host and port values in kv_transfer_params, with no authentication or user interaction required.

Blast radius

The impact could be significant for large inference deployments using vLLM's P2P KV offloading, potentially causing complete service outages across all inference requests until the system is manually restarted.

Detection

Monitor for ZMQError exceptions in EngineCore logs, particularly those related to socket exhaustion and peer session creation failures, and watch for EngineCore process crashes or restarts.

Prioritized remediation

Disable P2P KV offloading functionality immediately or upgrade to vLLM 0.29.1 or later which contains the fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.