CVE-2026-94625: vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests cr

vLLM (a language model serving framework) versions up to 0.29.0 have a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests (requests to prepare the AI model before full processing) leave behind unused data placeholders that never get cleaned up. An attacker can exploit this by sending many rejected requests to clog the system's worker pools, making legitimate requests wait up to 480 seconds while the system falsely reports it's healthy.