GPU Memory Exhaustion Vulnerability in vLLM Mooncake Connector by vLLM

CVE-2026-94627

What is CVE-2026-94627?

The vLLM Mooncake connector in versions up to 0.29.0 improperly manages GPU KV cache block ownership during concurrent child requests sharing a single transfer ID. This mismanagement can be exploited by attackers who submit multiple prompts within completion requests, leading to a buildup of orphaned KV cache blocks. The accumulation may result in GPU memory exhaustion, ultimately preventing the execution of legitimate requests until a process restart occurs.

References