{"action":"Upgrade vllm to 0.30.0 or later.","affected":[{"fixed":"0.30.0","introduced":"0"}],"component":"vllm","cve_ids":["CVE-2026-94625"],"ecosystem":"PyPI","epss":0.00521,"exploited":false,"fixed_versions":["0.30.0"],"id":"tcs_01M5KH97TBHC4T4DPGB6434BN8","modified_at":"2026-09-30T09:15:02.797516858Z","published_at":"2026-09-21T22:17:01.433Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4007","https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/mooncake/mooncake_connector.py#L1234-L1242","https://www.vulncheck.com/advisories/vllm-through-0.29.0-resource-exhaustion-via-ownerless-mooncake-transfer-placeholders","https://github.com/vllm-project/vllm/pull/51236","https://github.com/vllm-project/vllm"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-4007","url":"https://osv.dev/vulnerability/PYSEC-2026-4007"},{"source":"nvd","source_id":"CVE-2026-94625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94625"}],"summary":"vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can sen"}