Memory Exhaustion Vulnerability in vLLM by vLLM Project

CVE-2026-94626

What is CVE-2026-94626?

The vLLM software up to version 0.29.0 lacks proper validation of the 'tp_size' parameter in its OpenAI-compatible completion endpoints. This oversight allows attackers to provide arbitrary values for 'tp_size', potentially exhausting system memory resources. In scenarios involving prefilling or decoding in disaggregated deployments, this vulnerability can lead to significant system strain, culminating in an Out Of Memory (OOM) kill of the decoding worker process. Users should ensure they are using versions beyond 0.29.0 to mitigate this risk.

References