vLLM EUVD-2026-84221

Exploitation requires the target vLLM instance (version through 0.29.0) to be deployed in a prefill/decode (P/D) disaggregated configuration using the Mooncake KV-transfer connector - this is the specific, non-default feature that must be enabled; standard single-node vLLM serving is not affected. Given that topology, the attacker submits a completion request containing multiple prompts, whose concurrent child requests reuse a single transfer ID, causing GPU KV cache block ownership mismanagement and a persistent leak. The CVSS marks it unauthenticated (PR:N), remote (AV:N), low complexity (AC:L), with no user interaction, so no special privileges are required beyond reaching the API; the practical limiting factors are the non-default Mooncake/disaggregated deployment and any authentication or network controls fronting the inference endpoint. The leaked blocks persist until process restart, so a modest volume of crafted requests can degrade or deny service.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, score 8.7) describes a network-reachable, low-complexity, unauthenticated availability-only attack - no confidentiality or integrity impact, which aligns with CWE-401 (memory leak) resulting in resource exhaustion. This is a denial-of-service issue, NOT information disclosure as the single 'Information Disclosure' tag claims; the vector's VC:N/VI:N and VA:H directly contradict that tag. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so this is 'no public exploit identified at time of analysis' - the 8.7 is driven purely by the high, easily-triggered availability impact, not by evidence of real-world exploitation. Real-world risk is strongly gated by a non-default deployment: only vLLM instances running prefill/decode (P/D) disaggregated serving with the Mooncake connector are affected, which is a specialized topology, so the practical priority is far narrower than the headline score suggests. A fix exists (PR #49796) with scheduler-level rejection of duplicate transfer_ids plus worker-side block freeing, making patching the clear mitigation. Note the CVSS marks PR:N (unauthenticated) while many production inference endpoints sit behind an auth gateway - verify exposure before ranking urgency.

An attacker with network access to a vLLM inference endpoint running Mooncake-based P/D disaggregated serving submits completion requests containing multiple prompts, whose concurrent child requests collide on a single shared transfer ID. Each collision orphans GPU KV cache blocks that are never freed, so repeated requests steadily leak GPU memory until the cache is exhausted and legitimate inference requests can no longer be scheduled, requiring a process restart. No public exploit code is identified, but the trigger (a completion request with multiple prompts) is trivial given the low attack complexity.