CVE-2026-94625

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Sep 21, 2026, 10:00:00 PM UTC

Updated

Sep 21, 2026, 10:17:01 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.52% · Oct 25, 2026

A flaw was found in vLLM. A remote attacker can exploit this vulnerability by sending rejected prefill requests to the MooncakeConnector. This action creates ownerless transfer placeholders that are not properly reclaimed, leading to resource exhaustion. Consequently, legitimate requests may experience significant delays, up to 480 seconds, even though system health checks continue to report normal operation. vllm: vLLM: Resource exhaustion via rejected prefill requests This is an availability flaw in vLLM's MooncakeConnector, affecting Red Hat AI Inference Server and Red Hat OpenShift AI. Remote attackers can trigger resource exhaustion by sending rejected prefill requests, leading to service degradation and delays of up to 480 seconds for valid requests. This high impact on availability justifies the Important severity. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.