MediumVulnerability
CVE-2026-7141: vllm uninitialized resource in has_mamba_layers of KV Block Handler
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-7141
- Published
- Record updated
- Affected
- vllm < 0.19.1
- Fixed in
- 0.19.1
- released April 18, 2026, 9 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
A vulnerability in vllm up to 0.19.0 affects the function has_mamba_layers in vllm/v1/kv_cache_interface.py, part of the KV Block Handler component. Manipulating it leads to an uninitialized resource, and the attack can be launched remotely. The attack is rated high complexity and difficult to exploit, but a public exploit exists.
Mitigation
To fix this issue, it is recommended to deploy a patch. The patch is named 1ad67864c0c20f167929e64c875f5c28e1aad9fd.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- vllmPyPILLM dependency since 2023-08-25 · 15 tracked dependents
Topics
Related items
- HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
- HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
- MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
- MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
- MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News