CVE-2026-94623 vllm-project CVE debrief

Who should care

Defenders responsible for deploying and maintaining vLLM should assess exposure and prioritize patching or mitigation efforts. This includes teams managing AI and machine learning infrastructure, as well as security teams focused on protecting against denial-of-service attacks.

Why it matters

CVE-2026-94623 is a high-severity denial-of-service vulnerability affecting vLLM through version 0.29.0. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent service disruption.

• Denial of service: The vulnerability can cause the decode worker to terminate, leading to service disruption.
• Verification priority: Defenders should verify exposure and apply patches or mitigations to prevent exploitation.
• Patching priority: Vendors and defenders should prioritize patching or mitigating the vulnerability to prevent denial-of-service attacks.

Technical summary

The vulnerability is caused by the NIXL connector's prefix caching implementation failing to properly validate block counts across multi-prompt completion requests. This can be triggered by submitting completion requests with multiple prompts of varying lengths, causing the decode worker to terminate and become unavailable until restarted. The vulnerability can cause significant disruption to services, and defenders should prioritize verifying exposure and applying patches or mitigations to prevent denial-of-service attacks. The NIXL connector's prefix caching implementation is used in vLLM through version 0.29.0, and the vulnerability can be exploited by submitting completion requests with multiple prompts of

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations, as the vulnerability can cause significant disruption to services.

Recommended defensive actions

• Verify exposure by checking if the NIXL connector's prefix caching implementation is in use and if version 0.29.0 or earlier is deployed.
• Apply patches or mitigations provided by the vendor, such as updating to a version beyond 0.29.0.
• Monitor for suspicious completion requests with multiple prompts of varying lengths.
• Implement compensating controls, such as rate limiting or input validation, to reduce the attack surface.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed to exist in vLLM through version 0.29.0. The NIXL connector's prefix caching implementation fails to properly validate block counts across multi-prompt completion requests, leading to an assertion failure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.