CVE-2026-94626Patch(vllm / vllm)

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch vllm vllm systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel OOM-kill of the decode worker process.

vllm CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/vllm-project/vllm/pull/51137

Vendor / third-party advisories

https://www.vulncheck.com/advisories/vllm-through-0.29.0-memory-exhaustion-via-unvalidated-nixl-tp-size

Other references

Weakness type (CWE)

CWE-789

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

vllm

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 1 classified signal
Peaked 2d ago at 1 mentions (2026-09-21); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

vllm

Products

vllm

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Patch

266.7%

Disclosure

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-21	1	Disclosure1
2026-10-05	1	Patch1
2026-10-12	1	Patch1

Full discourse3 posts

DFIR Lab@DFIR_Lab26d
Patch
🚨 HIGH: CVE-2026-94626 (CVSS 7.5) vLLM ≤0.29.0 fails to validate tp_size parameter, allowing unbounded memory allocation. Attackers can exhaust memory & trigger OOM-kill of decode workers. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/G86pZTH2uf
Post summary
The post describes a vLLM input-validation vulnerability that can cause memory exhaustion and explicitly urges users to patch. It does not mention a PoC, exploit tool, or active exploitation.
0010076
150 followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters33d
Patch
CVE-2026-94626: vLLM to 0.29.0 skips validation of tp_size in kv_transfer_params on OpenAI-compatible endpoints, letting attackers exhaust memory and OOM-kill decode workers in disaggregated deployments. CVSS 7.5. Patch under https://www.valtersit.com/cve/CVE-2026-94626 #CVE #infosec #vLLM #vLLM #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
CVE‑2026‑94626 discloses a memory‑exhaustion flaw in vLLM 0.29.0 due to missing validation of tp_size in kv_transfer_params, enabling attackers to OOM‑kill decode workers; a patch is linked and available.
0000025
1.0K followersView on X
Kaitan ID Security@KaitanSecurity46d
Disclosure
⚠️ HIGH — CVE-2026-94626 vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpo… CVSS 7.5 Full analysis → https://sec.kaitan.id/cves/CVE-2026-94626 #OpenAI #CyberSecurity #InfoSec
Post summary
The tweet announces CVE-2026-94626 affecting vLLM through 0.29.0, describing a validation flaw in the tp_size parameter with CVSS 7.5, and links to a full analysis page. No patch, PoC, exploit tool, or active exploitation evidence is mentioned in the text.
0000068
90 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	vllm	vllm	-	-	-

Explore more

Back to dashboard vllm CVEs vllm vulnerabilities

What researchers are saying

CVE-2026-94626

DFIR Lab[verified]@DFIR_LabPatch

The post describes a vLLM input-validation vulnerability that can cause memory exhaustion and explicitly urges users to patch. It does not mention a PoC, exploit tool, or active exploitation.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersPatch

CVE‑2026‑94626 discloses a memory‑exhaustion flaw in vLLM 0.29.0 due to missing validation of tp_size in kv_transfer_params, enabling attackers to OOM‑kill decode workers; a patch is linked and available.

Kaitan ID Security[verified]@KaitanSecurityDisclosure

The tweet announces CVE-2026-94626 affecting vLLM through 0.29.0, describing a validation flaw in the tp_size parameter with CVSS 7.5, and links to a full analysis page. No patch, PoC, exploit tool, or active exploitation evidence is mentioned in the text.