Bug 2538868 (CVE-2026-94625)
| Summary: | CVE-2026-94625 vllm: vLLM: Resource exhaustion via rejected prefill requests | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | alinfoot, bbrownin, dtrifiro, weaton |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in vLLM. A remote attacker can exploit this vulnerability by sending rejected prefill requests to the MooncakeConnector. This action creates ownerless transfer placeholders that are not properly reclaimed, leading to resource exhaustion. Consequently, legitimate requests may experience significant delays, up to 480 seconds, even though system health checks continue to report normal operation.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-09-22 20:59:31 UTC
|