CVE-2026-94624

vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can supply arbitrary remote host and port values in kv_transfer_params to create unreachable peer sessions that retain ZeroMQ sockets until the context quota is exhausted, causing an uncaught ZMQError that crashes EngineCore and stops all inference.

• CWE-770

• https://github.com/vllm-project/vllmProduct
• https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/kv_offload/tiering/p2p/control/zmq.py#L240-L260Product
• https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/kv_offload/tiering/p2p/manager.py#L667-L677Product
• https://github.com/vllm-project/vllm/pull/51504Issue Tracking, Patch
• https://www.vulncheck.com/advisories/vllm-through-0.29.0-denial-of-service-via-unbounded-p2p-kv-offloading-sessionsThird Party Advisory

Published

Sep 21, 2026

Last Modified

Sep 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-94619FileGator is a multi-user file manager. Prior to 7.15.0, POS…5.9
• CVE-2026-9462A vulnerability was detected in Edimax EW-7438RPn 1.31. Affe…8.8
• CVE-2026-94620Classroom 50 is a free and open-source tool for managing and…9.4
• CVE-2026-94621AliasVault is a privacy-first password manager with built-in…6.3
• CVE-2026-94622vLLM versions through 0.29.0 contain a denial of service vul…7.5
• CVE-2026-94623vLLM through 0.29.0 contains a denial of service vulnerabili…7.5
• CVE-2026-94625vLLM through 0.29.0 contains a resource exhaustion vulnerabi…5.3
• CVE-2026-94626vLLM through 0.29.0 fails to validate the tp_size parameter …7.5
• CVE-2026-94627vLLM Mooncake connector through 0.29.0 fails to properly man…7.5
• CVE-2026-9463A flaw has been found in Edimax EW-7438RPn 1.31. Affected by…8.8
• CVE-2026-94632Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-94633Memory allocation with excessive size value, Improper handli…8.7