CVE-2026-94625 in vLLM
Summary
by MITRE • 09/22/2026
vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 480 seconds while health checks continue returning success.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vLLM framework through version 0.29.0 contains a critical resource exhaustion vulnerability within the MooncakeConnector component that stems from improper handling of rejected prefill requests during inference operations. This flaw allows an attacker to systematically deplete system resources by exploiting the lifecycle management logic associated with transfer placeholders. When a prefill request is rejected, typically due to capacity constraints or policy violations, the connector creates internal data structures known as ownerless transfer placeholders intended to manage the state of these failed interactions. However, the implementation fails to properly reclaim or garbage collect these objects after rejection, leading to their accumulation in memory and associated task pools over time.
From a technical perspective, this vulnerability represents a classic case of resource leak due to missing cleanup logic in error handling paths. The MooncakeConnector maintains sender task pools that are responsible for managing the execution context of inference requests. Each rejected prefill request leaves behind an orphaned placeholder object that remains attached to these pools but is no longer associated with any active owner or processing thread. As more maliciously crafted or simply high-volume rejected requests are submitted, these placeholders accumulate without bound. This behavior effectively creates a memory leak and a logical resource exhaustion scenario where the internal data structures grow indefinitely until they consume available system resources.
The operational impact of this vulnerability is severe for both availability and performance stability within large language model serving environments. Attackers can exploit this flaw by sending a sustained stream of rejected prefill requests to exhaust the sender task pools. As these pools become saturated with orphaned placeholders, legitimate inference traffic faces significant delays in processing. The system may experience latency spikes where valid requests are delayed by up to 480 seconds before they can be executed. This degradation occurs despite health checks continuing to report success because the underlying infrastructure remains technically operational and responsive at a low level, masking the severe performance bottleneck from automated monitoring systems that rely on simple availability metrics rather than throughput or latency measurements.
This vulnerability aligns with CWE-772 Missing Release of Resource after Effective Lifetime, as the system fails to release internal resources associated with rejected requests. It also maps to MITRE ATT&CK technique T1499 Endpoint Denial of Service under Volume-Based attacks, where an adversary overwhelms a target by consuming computational or memory resources rather than crashing it outright. The persistence of these orphaned objects allows for a slow-burn denial of service that is difficult to detect through standard uptime monitoring because the application process does not terminate but becomes functionally impaired due to resource contention and scheduling delays.
Mitigation strategies should focus on immediate patching to version 0.30.0 or later where this logic has been corrected, ensuring that rejected prefill requests trigger proper cleanup routines for all associated transfer placeholders. In environments where upgrading is not immediately feasible, administrators can implement rate limiting at the network edge to restrict the volume of incoming inference requests and reduce exposure to rapid rejection cycles. Additionally, configuring monitoring systems to track internal metrics such as queue depth, memory usage trends related to connector components, and request latency distributions rather than relying solely on health check status codes will enable earlier detection of this resource exhaustion pattern before it causes significant service degradation.