CVE-2026-94623

Received Received - Intake

Denial of Service in vLLM via Prefix Caching Flaw

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulnCheck

Description

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in NixlBaseConnectorWorker._apply_prefix_caching by submitting completion requests with multiple prompts of varying lengths, causing the decode worker to terminate and become unavailable until restarted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-94623

EUVD

EUVD-2026-84217

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This is a denial of service vulnerability in vLLM versions up to 0.29.0. It affects the NIXL connector's prefix caching feature in deployments where prefill and decode tasks are separated. Attackers can exploit it by sending multiple prompts of different lengths, causing an assertion failure that crashes the decode worker. The worker becomes unavailable until manually restarted.

Detection Guidance

This vulnerability can be detected by monitoring for assertion failures in the NixlBaseConnectorWorker._apply_prefix_caching function during multi-prompt completion requests. Check logs for decode worker terminations without explicit shutdown commands. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability can disrupt services relying on vLLM for multi-prompt completion tasks. The decode worker crash may lead to service unavailability, delayed responses, or complete downtime for affected systems until the worker is restarted. This impacts performance and reliability of AI-powered applications using vLLM.

Compliance Impact

This vulnerability causes a denial of service by terminating decode workers, leading to service unavailability. This could disrupt access to sensitive data processing, potentially violating availability requirements in GDPR and HIPAA.

Mitigation Strategies

Upgrade vLLM to a version beyond 0.29.0 where the prefix caching validation issue is resolved. If immediate upgrade is not possible, restrict access to prefill/decode disaggregated deployments to prevent multi-prompt completion requests.

Hi! I’m here to help you understand CVE-2026-94623. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70