vLLM EUVD-2026-84216

Requires the target vLLM instance (version through 0.29.0) to be deployed in prefill/decode disaggregated mode using the NIXL connector - a non-default serving configuration. Given that mode, exploitation needs only network access to the inference API and a single request carrying an incomplete kv_transfer_params dictionary (missing required remote_* fields such as remote_block_ids/remote_engine_id/remote_request_id/remote_host/remote_port); no authentication (PR:N) and no user interaction are needed. The limiting factor is the deployment mode itself: standard single-node vLLM without NIXL disaggregation does not process kv_transfer_params in this path and is not exposed. Impact is a full decode-engine crash requiring manual restart to recover.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VA:H, C/I both N) is internally consistent and credible: a remote, unauthenticated, low-complexity request crashes the decode EngineCore, and the only impact is availability - no confidentiality or integrity loss. The 8.7 score is driven purely by the availability hit plus the trivial preconditions. However, this raw score materially overstates fleet-wide risk because exploitation is GATED on a specific non-default deployment mode: the NIXL connector configured for prefill/decode disaggregated serving. Standard single-node vLLM deployments are not exposed. No EPSS score, no CISA KEV listing, and no standalone public exploit were provided - VulnCheck disclosed it and a fix PR (#54807) with regression tests exists, but there is no evidence of active exploitation. So this is a real, easy-to-trigger, unauthenticated crash-until-manual-restart DoS for the subset of operators running disaggregated NIXL setups, and should be prioritized by them; for everyone else the practical risk is near zero. Signals are consistent (no CVSS-vs-description conflict), the main caveat is the missing EPSS/KEV/POC data, which means likelihood-of-exploitation is inferred from the low attack complexity rather than confirmed telemetry.

An attacker with network reach to a vLLM instance running disaggregated prefill/decode with the NIXL connector sends an inference request whose kv_transfer_params dict is deliberately incomplete (e.g. only {"do_remote_prefill": true}, omitting remote_block_ids/remote_engine_id/remote_host/etc.). add_new_req_to_recv dereferences the missing keys, raising an uncaught KeyError inside EngineCore scheduling that terminates the decode engine, so every routed request fails until an operator manually restarts the service. No public exploit code was identified, but the trigger is a single malformed request requiring no authentication or user interaction.