CVE-2026-94622

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.1

Description A denial of service issue exists in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. An attacker can send requests containing incomplete kv transfer params dictionary entries, which triggers an uncaught KeyError during EngineCore scheduling. This results in the termination of the decode engine, causing all routed requests to fail until the system is manually restarted.

Recommendations Update vLLM to a version newer than 0.29.0.