CVE-2026-94625

Summary

The vulnerability allows attackers to send rejected prefill requests that create ownerless transfer placeholders, leading to resource exhaustion and delayed processing of valid requests.

Exploitability

Exploitation requires sending specific rejected requests; it is moderately difficult due to the need for understanding the system's request handling mechanisms.

Blast radius

If exploited, this could significantly impact service availability by delaying or blocking valid requests, affecting user experience and potentially leading to operational disruptions.

Prioritized remediation

Update vLLM to version 0.29.1 or later, which addresses this vulnerability according to the project's security updates.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.