CVE-2026-94622 in vLLM
Summary
by MITRE • 09/22/2026
vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kv_transfer_params dictionary entries to trigger an uncaught KeyError in EngineCore scheduling, causing the decode engine to terminate and making all routed requests fail until manual restart.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in vLLM versions through 0.29.0 represents a critical denial of service flaw within the NIXL connector's metadata handling mechanisms for prefill and decode disaggregated deployments. In these distributed inference architectures, the workload is split between separate engine instances responsible for different phases of request processing. The specific failure point occurs during the scheduling phase in EngineCore when it attempts to process incoming requests that rely on key-value transfer parameters. These parameters are essential for maintaining state consistency across the disaggregated components, ensuring that context information generated by the prefill engine is correctly passed to and utilized by the decode engine.
The technical root cause of this vulnerability lies in insufficient input validation within the metadata handling logic. Specifically, when an attacker sends a request containing incomplete or malformed kv_transfer_params dictionary entries, the system fails to validate the presence of required keys before attempting access. This oversight leads directly to an uncaught KeyError exception during the execution flow of EngineCore scheduling. Because this exception is not properly caught and handled by the application's error management routines, it propagates up the call stack without graceful degradation or recovery mechanisms in place.
The operational impact of this flaw is severe for any production environment relying on disaggregated inference deployments. The unhandled KeyError causes the decode engine process to terminate abruptly rather than rejecting the malformed request gracefully. This termination results in a complete service outage for all requests currently routed through that specific instance. Since the decode engine is responsible for generating output tokens, its failure means that no further responses can be generated until the affected component is manually restarted by an administrator or automated recovery script. This creates a significant availability gap and requires immediate intervention to restore normal operations.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to adequately verify user-supplied data before processing it. Additionally, because the attack vector involves sending specific malformed requests to trigger a crash that disrupts service availability, it maps closely to MITRE ATT&CK technique T1499 Endpoint Denial of Service. The attacker does not need elevated privileges or complex exploitation chains; simply crafting a request with missing dictionary keys is sufficient to cause system instability.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. For users currently running vulnerable versions, the primary mitigation is upgrading vLLM to version 0.29.1 or later where this issue has been addressed through enhanced input validation logic. In environments where an upgrade is not immediately feasible, implementing a reverse proxy or API gateway with strict schema validation can filter out malformed requests before they reach the inference engine. Additionally, deploying health checks and automated restart policies for decode engines can reduce downtime by automatically recovering from crashes while maintaining overall service availability during the transition period.