CVE-2026-93436 in vLLM
Summary
by MITRE • 09/18/2026
vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max_tokens=0 to exhaust decode-worker memory without bound until the worker restarts.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in vLLM versions through 0.29.0 represents a critical resource exhaustion flaw within distributed inference architectures that utilize prefill and decode disaggregation. In such deployments, the workload is split between two distinct types of workers: prefills handle the initial processing of input tokens to generate key-value caches, while decodes manage the iterative generation of output tokens using those cached states. The core technical failure lies in the lifecycle management of metadata associated with inference requests that are rejected or terminated prematurely by the decode-side worker. Specifically, when a request is submitted with max_tokens set to zero, it signals an intent for immediate completion or rejection without generating any actual text output. However, the system fails to properly release and clean up the internal data structures allocated for tracking this specific type of request during its brief existence on the decode side.
This lack of proper cleanup results in a memory leak that accumulates with every such rejected request. Because remote attackers can submit these malformed requests at scale, they can trigger an unbounded consumption of random access memory on the decode workers. The allocated metadata structures are not freed from memory even after the request is deemed invalid or completed instantly. Over time, this continuous allocation without corresponding deallocation leads to a gradual but inevitable saturation of available system resources. This behavior effectively transforms a simple configuration error into a potent vector for Denial of Service attacks against large language model serving infrastructure.
The operational impact of this vulnerability is severe, primarily manifesting as service degradation or complete unavailability of the inference endpoint. As decode workers exhaust their memory limits, they may begin to swap heavily to disk, causing significant latency spikes that render real-time generation impossible for legitimate users. Eventually, the operating system's out-of-memory killer will terminate the worker processes to protect the rest of the system. This results in a forced restart cycle where services become temporarily unavailable until the workers recover and reload their model weights into memory. For high-throughput production environments, this not only disrupts user experience but also incurs substantial computational costs due to repeated cold starts and resource reallocation efforts by administrators attempting to maintain service availability.
From a classification perspective, this flaw aligns with CWE-401, which describes the improper release of memory or resources before it is no longer needed, leading to resource leaks. Furthermore, in the context of adversarial tactics, this vulnerability facilitates an attack pattern consistent with ATT&CK technique T1498, Network Denial of Service, specifically through resource exhaustion via application layer abuse rather than network bandwidth saturation. The attacker leverages legitimate API endpoints and parameters to trigger internal inefficiencies, bypassing traditional volume-based DDoS detection mechanisms that monitor traffic rates rather than semantic request content.
Mitigation strategies must address both immediate remediation and long-term architectural resilience. The primary solution is to upgrade the vLLM deployment to version 0.29.1 or later, where this specific metadata cleanup logic has been corrected to ensure proper deallocation of resources for rejected requests. For environments that cannot immediately patch due to dependency constraints, operational mitigations include implementing strict rate limiting and input validation at the reverse proxy or API gateway level before requests reach the vLLM workers. Administrators should configure guards that reject any inference request specifying max_tokens equal to zero unless explicitly required by specific use cases, thereby preventing the trigger condition from ever reaching the vulnerable code path. Additionally, monitoring memory usage trends on decode workers can provide early warning indicators of such exploitation attempts, allowing for proactive intervention before total service failure occurs.