CVE-2026-94622

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kv_transfer_params dictionary entries to trigger an uncaught KeyError in EngineCore scheduling, causing the decode engine to terminate and making all routed requests fail until manual restart.

• CWE-248

• https://github.com/vllm-project/vllmProduct
• https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/nixl/metadata.py#L294-L312Product
• https://github.com/vllm-project/vllm/pull/54807Issue Tracking, Patch
• https://www.vulncheck.com/advisories/vllm-through-0.29.0-denial-of-service-via-incomplete-nixl-kv-transfer-metadataThird Party Advisory

Published

Sep 21, 2026

Last Modified

Sep 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-94613authentik is an open-source identity provider. Prior to 2026…7.5
• CVE-2026-94618FileGator is a multi-user file manager. Prior to 7.15.0, GET…5.4
• CVE-2026-94619FileGator is a multi-user file manager. Prior to 7.15.0, POS…5.9
• CVE-2026-9462A vulnerability was detected in Edimax EW-7438RPn 1.31. Affe…8.8
• CVE-2026-94620Classroom 50 is a free and open-source tool for managing and…9.4
• CVE-2026-94621AliasVault is a privacy-first password manager with built-in…6.3
• CVE-2026-94623vLLM through 0.29.0 contains a denial of service vulnerabili…7.5
• CVE-2026-94624vLLM through 0.29.0 contains a denial of service vulnerabili…7.5
• CVE-2026-94625vLLM through 0.29.0 contains a resource exhaustion vulnerabi…5.3
• CVE-2026-94626vLLM through 0.29.0 fails to validate the tp_size parameter …7.5
• CVE-2026-94627vLLM Mooncake connector through 0.29.0 fails to properly man…7.5
• CVE-2026-9463A flaw has been found in Edimax EW-7438RPn 1.31. Affected by…8.8