{"data":{"id":"a2b5af22-102b-4ed9-aa26-ab47e76bc976","title":"CVE-2026-94627: vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child…","summary":"The vLLM Mooncake connector through 0.29.0 does not properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. An attacker can submit completion requests with multiple prompts to trigger GPU memory exhaustion, as orphaned KV cache blocks accumulate until the process restarts and legitimate requests can no longer execute.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94627","publishedAt":"2026-09-21T22:17:01.740Z","cveId":"CVE-2026-94627","cweIds":["CWE-401"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["vLLM","Mooncake connector"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM Mooncake connector flaw enables memory exhaustion","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00627,"epssCheckedAt":"2026-11-09T18:09:53.615Z","kevDateAdded":null,"advisoryAliases":["GHSA-pjfg-w894-9457"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-08T06:09:38.696Z","patchAvailable":null,"disclosureDate":"2026-09-21T22:17:01.740Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}