CVE-2026-94623: vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation tha

vLLM versions up to 0.29.0 have a denial of service vulnerability in its NIXL connector's prefix caching (a feature that reuses parts of previously processed text to speed up responses) that doesn't properly check block counts when handling multiple prompts of different lengths in certain deployment setups. An attacker can crash the decode worker (the part that generates responses) by sending specially crafted requests, forcing a restart to restore service.