Denial of Service Vulnerability in vLLM by vLLM Project

CVE-2026-94624

What is CVE-2026-94624?

The vLLM product, up to version 0.29.0, is susceptible to a denial of service vulnerability rooted in the Peer-to-Peer (P2P) key-value (KV) offloading mechanism. When the OffloadingConnector is configured with the TieringOffloadingSpec parameter against a peer-to-peer secondary tier, attackers can input arbitrary remote host and port configurations into the kv_transfer_params. This can lead to the establishment of unreachable peer sessions that maintain ZeroMQ sockets, ultimately draining the context quota. This exhaustion results in an uncaught ZMQError, which crashes EngineCore and halts all inference processes, significantly impacting system performance.

References