CVE-2026-94623

[CVE catalog]

Severity

High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Sep 21, 2026, 10:00:00 PM UTC

Updated

Sep 21, 2026, 10:17:01 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.63% · Oct 25, 2026

A flaw was found in vLLM. This denial of service vulnerability exists within the NIXL connector's prefix caching implementation. A remote attacker can exploit this by sending completion requests with multiple prompts of different lengths. This improper validation of block counts causes an assertion failure, leading to the termination and unavailability of the decode worker until it is restarted. vllm: vLLM: Denial of Service via NIXL multi-prompt assertion failure Red Hat has evaluated this vulnerability as having an Important severity because remote, unauthenticated API consumers can induce process termination in distributed inference workers, producing a persistent denial of service across shared serving endpoints. The issue specifically impacts prefill and decode disaggregated architectures configured with NIXL KV-cache transfer, where varying-length prompt batches trigger an unhandled internal assertion failure. Standard single-node or non-disaggregated deployments of vLLM in Red Hat OpenShift AI and Red Hat Enterprise Linux AI that do not configure NIXL for distributed cache coordination are not exposed to this crash. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.