CVE-2026-94627: vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child reque

A vulnerability in vLLM Mooncake connector (a component that helps distribute AI model processing across systems) through version 0.29.0 fails to properly track ownership of GPU KV cache blocks (temporary storage on graphics processors for speeding up AI responses) when multiple child requests share the same transfer ID. Attackers can exploit this by sending completion requests with multiple prompts, causing orphaned cache blocks to build up until the system restarts, eventually blocking legitimate user requests from running.