CVE-2026-94627

Summary

The flaw allows attackers to trigger GPU memory exhaustion by submitting multiple completion requests, leading to orphaned KV cache blocks and preventing legitimate requests from executing.

Exploitability

Exploitation requires concurrent child requests sharing a single transfer ID in specific deployment scenarios; moderately complex setup but feasible with targeted attacks.

Blast radius

If exploited, the impact is high as it can prevent any further legitimate requests from being processed until system restarts.

Prioritized remediation

Update to vLLM Mooncake connector version 0.29.1 or later which addresses this vulnerability.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.