EUVD-2026-84217
GHSA-g3cp-v4cp-9xfq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vLLM NIXL disaggregated endpoint
-
DeliverySend multi-prompt completion with kv_transfer_params
-
ExploitTrigger block-count assertion in _apply_prefix_caching
-
ExecutionCrash decode worker
-
ImpactServing unavailable until restart
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Requires the target to run vLLM 0.29.0 or earlier configured for a prefill/decode DISAGGREGATED deployment using the NIXL KV-transfer connector - a non-default, advanced multi-worker serving topology. The attacker must be able to reach the OpenAI-compatible completion API (network, no authentication per PR:N) and submit a completion request with MULTIPLE prompts of varying lengths carrying kv_transfer_params; single-prompt requests do not trigger the flaw (confirmed by the PR's test_single_prompt_with_kv_transfer_params_allowed). The primary limiting factor is the required disaggregated NIXL architecture: standard single-node vLLM deployments are not affected. Impact is limited to availability (decode worker crash requiring manual restart); no data disclosure or code execution. |
| Impact | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, score 8.7) is a pure availability impact with no confidentiality or integrity effect, correctly reflecting CWE-617 (reachable assertion → crash). The high score is driven entirely by VA:H combined with unauthenticated network reach. However, that score does NOT account for a significant gating factor stated plainly in the description: the flaw only exists in the NIXL connector's prefix-caching path used in prefill/decode DISAGGREGATED deployments - a non-default, advanced serving topology. The PR #51505 test names confirm the trigger requires 'kv_transfer_params' set on a multi-prompt completion request, further narrowing the attack surface to disaggregated setups. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis'. Net: for the minority of vLLM operators running NIXL disaggregated serving this is a genuine, easy, unauthenticated availability threat and should be patched promptly; for the default single-node deployment it is not reachable. The 8.7 base score overstates real-world priority for typical deployments because AT:N ignores the required non-default architecture. Signals are consistent (all point to availability-only DoS) but the raw score should be read against the deployment gate. |
| Exploit ScenarioDerived | An attacker with network access to a vLLM OpenAI-compatible endpoint running an NIXL prefill/decode disaggregated deployment sends a completion request containing multiple prompts of varying lengths together with kv_transfer_params. The mismatched block counts trip an assertion in NixlBaseConnectorWorker._apply_prefix_caching, crashing the decode worker, which stays unavailable until an operator restarts it. No authentication or user interaction is required and the request is trivially repeatable; no public exploit code was identified, though the fixing PR includes clear reproduction tests. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Denial of service in vLLM through 0.29.0 allows an unauthenticated remote attacker to crash the NIXL decode worker by submitting a single OpenAI-compatible completion request containing multiple prompts of differing lengths together with kv_transfer_params. The crash occurs in NixlBaseConnectorWorker._apply_prefix_caching, where block-count mismatches between the decode and prefill sides hit a reachable assertion (CWE-617); the decode worker terminates and stays unavailable until manually restarted, so a low-effort request loop can repeatedly take serving capacity offline. Impact is confined to availability (CVSS 4.0 8.7, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H), with no confidentiality or integrity effect, and exploitation is gated on a non-default prefill/decode DISAGGREGATED topology that uses the NIXL KV-transfer connector - standard single-node vLLM serving is not affected. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, though the trigger is a trivially crafted multi-prompt API call.
RemediationAI
Vendor-released patch: vLLM PR #51505, which replaces the reachable assertions in _apply_prefix_caching with ValueError raises and adds API-layer rejection of multi-prompt completions that carry kv_transfer_params (advisory reference https://github.com/vllm-project/vllm/pull/51505; tracking ID GHSA-6vh8-5j8f-m4vf). Because no tagged release containing the fix was confirmed in the input data, treat this as an upstream fix available (PR/commit) with the released patched version not independently confirmed - verify against the vLLM release notes or pin to a build containing the merged PR before relying on it. Where upgrading is not immediately possible, the highest-value compensating control is to enforce the same input rule at the edge: reject or strip completions that combine multiple prompts with kv_transfer_params (a single prompt with kv_transfer_params is safe), which is precisely the guard the patch installs; the trade-off is that legitimate multi-prompt KV-transfer workloads are blocked. Alternative mitigations: disable prefix caching on the NIXL connector for disaggregated deployments, at the cost of substantially reduced prefill/decode cache reuse and higher latency; temporarily fall back to a non-disaggregated serving topology, which removes the vulnerable code path entirely but sacrifices disaggregation's throughput and scaling benefits; or restrict the OpenAI-compatible completion endpoint to trusted networks/API gateways, which reduces the attack surface but does not fix the flaw and is weak given the request requires no authentication (PR:N). Deployments should also add decode-worker liveness/auto-restart supervision, since the impact is a worker crash requiring restart rather than data compromise - this is a resilience measure, not a fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vLLM's disaggregated serving splits inference into separate prefill and decode workers that exchange key/value cache blocks over the NIXL (NVIDIA Inference Xfer Library) KV connector. When prefix caching is enabled, NixlBaseConnectorWorker._apply_prefix_caching reconciles the logical block layout produced by the prefill side against the blocks the decode side has allocated, padding or pairing groups as needed. For multi-prompt completion batches, each prompt of different length produces a different block count, and the connector's accounting (including the Mamba/SSM padding path controlled by _has_mamba and _physical_blocks_per_logical_kv_block) can yield num_decode_blocks greater than the number of prefill groups or an unpairable SSM slot count. The original code guarded these invariants with bare assert statements (sites now at base_worker.py around lines 2427-2491), so a violated invariant raises AssertionError, which is not a recoverable request-level error and kills the decode worker process. That maps directly to CWE-617 (Reachable Assertion): rather than validating untrusted request-derived input and returning a clean error, the worker trusts internal consistency and aborts. The upstream fix (vLLM PR #51505, tracked as GHSA-6vh8-5j8f-m4vf) does two things: it converts the three prefix-caching assertions into explicit ValueError raises, and it adds request validation in the OpenAI completion entrypoint that rejects multi-prompt completions carrying kv_transfer_params while still allowing the single-prompt case - a regression test in tests/entrypoints/openai/completion/test_completion_error.py asserts exactly that split.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Unauthenticated network request reliably crashes the decode worker (A:H, availability-only); AC:L since the request itself is simple, though real reach is gated by the non-default NIXL disaggregated deployment.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in NixlBaseConnectorWorker._apply_prefix_caching by submitting completion requests with multiple prompts of varying lengths, causing the decode worker to terminate and become unavailable until restarted.
Blast Radius
ecosystem impact- 3 pypi packages depend on vllm (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.30.0.
Executive ViewAI
vLLM deployments through version 0.29.0 that use a disaggregated prefill/decode topology with the NIXL KV-transfer connector are exposed to a high-severity denial-of-service flaw (CVE-2026-94623, CVSS 8.7). An unauthenticated remote attacker can submit a single specially crafted OpenAI-compatible completion request to crash the NIXL decode worker, and a low-effort loop can repeatedly take serving capacity offline until manual restart. This affects availability of AI inference services, potentially disrupting customer-facing applications and internal workloads that depend on them; standard single-node vLLM serving is not impacted.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the NIXL KV-transfer connector or switch to standard single-node vLLM serving if disaggregated topology is not required; enforce authentication and rate limiting at the API gateway; validate and reject multi-prompt requests containing kv_transfer_params with mismatched block counts; monitor decode worker health and configure automatic restart to minimize downtime.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Vllm versions up to 0.12.0 is affected by allocation of resources without limits or throttling (CVSS 6.5).
Race condition in vLLM's prompt embedding loader allows concurrent API requests to bypass the sparse tensor invariant gu
Exploit-DB