{"uuid": "7abd8330-ebf5-4ddd-8b36-1e45122a7934", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94626", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117388897434222843", "content": "CVE-2026-94626: vLLM to 0.29.0 skips validation of tp_size in kv_transfer_params on OpenAI-compatible endpoints, letting attackers exhaust memory and OOM-kill decode workers in disaggregated deployments. CVSS 7.5. Patch under https://www.valtersit.com/cve/CVE-2026-94626/ #CVE #infosec #vLLM", "creation_timestamp": "2026-10-05T15:00:47.946473Z"}