VulnSocial

CVE-2026-94624(vllm / vllm)

LOWCVSS 8.7 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can supply arbitrary remote host and port values in kv_transfer_params to create unreachable peer sessions that retain ZeroMQ sockets until the context quota is exhausted, causing an uncaught ZMQError that crashes EngineCore and stops all inference.

vllm CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • vllm

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Affected systems

Vendors
vllm
Products
vllm

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-10-07: 210-07
Referenced assets2 URLs
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters

    CVE-2026-94624 vLLM DoS: crafted kv_transfer_params spawn unreachable ZMQ peer sessions until the context quota is exhausted, crashing EngineCore and killing all inference. CVSS 7.5. Patch under review - restrict peer hosts and https://www.valtersit.com/cve/CVE-2026-94624/ #CVE #infosec #vLLM #vLLM #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    0000015
    1.1K followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters

    CVE-2026-94624 vLLM DoS: crafted kv_transfer_params spawn unreachable ZMQ peer sessions until the context quota is exhausted, crashing EngineCore and killing all inference. CVSS 7.5. Patch under review - restrict peer hosts and https://www.valtersit.com/cve/CVE-2026-94624 #CVE #infosec #vLLM #vLLM #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    0000016
    1.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appvllmvllm---

Explore more

Back to dashboardvllm CVEsvllm vulnerabilities