Upwind Security MDR@UpwindMDR
Disclosure
🚨HIGH - vLLM Decode Worker Memory Exhaustion via max_tokens=0 (CVE-2026-93436) In vLLM disaggregated prefill/decode deployments, rejected inference requests don’t fully clean up decode-side metadata. An attacker can spam requests with max_tokens=0 to force unbounded memory growth on the decode worker, exhausting RAM until restart (DoS). Non-disaggregated deployments aren’t affected. 👉Affected: vllm <= 0.29.0
Post summary
The text announces CVE-2026-93436, a DoS vulnerability in vLLM's decode worker caused by memory exhaustion via max_tokens=0, providing technical mechanism details and affected version scope (vllm <= 0.29.0) without any PoC, exploit tool, or patch information.
0001094
305 followersView on X