CVE-2026-7141

[CVE catalog]

Severity

Medium · CVSS 5.6CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Published

Apr 27, 2026, 4:45:12 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.29% · Oct 25, 2026

A flaw was found in vllm. A remote attacker can exploit a vulnerability in the `has_mamba_layers` function within the KV Block Handler component. By performing a specific manipulation, an uninitialized resource can be triggered, potentially leading to information disclosure or denial of service. The attack is considered to have high complexity, and exploitation is difficult. vllm: vllm: Uninitialized resource in KV Block Handler via has_mamba_layers function This Moderate impact vulnerability in vllm, affecting Red Hat AI Inference Server, Red Hat OpenShift AI, and Red Hat Enterprise Linux AI, involves an uninitialized resource in the `has_mamba_layers` function. Exploitation by a remote attacker could lead to information disclosure or denial of service, but the attack complexity is high, making exploitation difficult. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.