{"data":{"id":"7820d778-0192-47eb-a375-35f07e245acc","title":"CVE-2026-94625: vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests…","summary":"CVE-2026-94625 affects vLLM through 0.29.0 in MooncakeConnector. Rejected prefill requests leave ownerless transfer placeholders that are never reclaimed, so an attacker can send such requests to exhaust sender task pools. Valid requests can then be delayed by up to 480 seconds while health checks keep returning success.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94625","publishedAt":"2026-09-21T22:17:01.433Z","cveId":"CVE-2026-94625","cweIds":["CWE-772"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["vLLM","MooncakeConnector"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM resource exhaustion in MooncakeConnector through rejected prefill requests","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00521,"epssCheckedAt":"2026-11-09T18:09:52.268Z","kevDateAdded":null,"advisoryAliases":["GHSA-9p52-m77h-4wq5"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-08T06:09:39.549Z","patchAvailable":null,"disclosureDate":"2026-09-21T22:17:01.433Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}