PT-2026-96315

CVE-2026-94625

تاريخ النشر

2026-09-21

تاريخ التحديث

2026-09-29

الوصف من

CVSS 4.0

6.9

متوسطة

المقاييسAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.1

Description A resource exhaustion issue exists in the MooncakeConnector component. Rejected prefill requests generate ownerless transfer placeholders that are not reclaimed by the system. An attacker can exploit this by sending rejected requests to exhaust sender task pools, which results in valid requests being delayed by up to 480 seconds. During this state, health checks continue to report success, masking the issue.

Recommendations Update vLLM to a version newer than 0.29.0.

قابلية الاستغلال

استغلال

إصلاح

التأثيرات

الباحثون

Jiajia Liu

Jiapeng Li

Mingkai Yu

المورّدون

المنتجات المتأثرة

تصنيف نقاط الضعف