CVE-2026-94622: vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for pre

vLLM (a system for running large language models) versions up to 0.29.0 have a denial of service vulnerability (a flaw that lets attackers crash a service) in how the NIXL connector handles metadata for split deployments. An attacker can send specially crafted requests that cause an uncaught KeyError (a programming error where the code tries to access a dictionary key that doesn't exist) in the scheduling system, crashing the decode engine and forcing a manual restart to recover.