CVE-2026-94626
Description
A flaw was found in vLLM. A remote attacker can exploit a vulnerability in the kv_transfer_params function on OpenAI-compatible completion endpoints by supplying an unvalidated tp_size parameter. This allows for unbounded memory allocation, leading to memory exhaustion and a kernel Out-Of-Memory (OOM) kill of the decode worker process. This ultimately results in a Denial of Service (DoS) for the affected system.
Statement
This vulnerability is rated as Important severity because unauthenticated remote attackers can cause an out-of-memory denial of service condition without special privileges, terminating active inference worker processes. In Red Hat OpenShift AI and Red Hat AI Inference Server deployments utilizing disaggregated prefill and decode architectures, completion endpoints exposed to untrusted networks can receive crafted transfer parameters that trigger excessive memory consumption. This memory exhaustion causes the host kernel to abort the decode worker, interrupting model serving for all users on the affected node.
Mitigation
Restrict network exposure of the OpenAI-compatible completion service by enforcing OpenShift NetworkPolicies or firewall rules so that only authenticated API gateways and trusted internal clients can access the endpoint. In addition, avoid configuring disaggregated prefill and decode deployments for publicly exposed services, opting instead for monolithic serving architectures where inter-process KV transfer parameters are not accepted from external completion requests.
Caveats: Limiting network reachability requires client traffic to be routed through trusted ingress proxies. Modifying deployment configurations or cluster network policies may require restarting the inference service pods, resulting in brief service downtime.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
