Resource Exhaustion in vLLM MooncakeConnector via Unreclaimed Prefill Requests

Executive Summary

vLLM through 0.29.0 has a resource exhaustion flaw in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never cleaned up. Attackers can exploit this by sending rejected requests to deplete sender task pools, causing valid requests to be delayed by up to 480 seconds while health checks falsely report normal operation.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusually high numbers of rejected prefill requests in vLLM logs or network traffic. Check for sender task pool exhaustion by examining system resource usage and task queue metrics. Look for delays in request processing exceeding normal thresholds.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial-of-service conditions where your system becomes unresponsive or slow due to resource exhaustion. Valid requests may be delayed significantly, disrupting services that rely on timely processing.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR and HIPAA by causing service disruptions or delays in processing requests due to resource exhaustion. However, the provided CVE data does not explicitly detail compliance implications.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade vLLM to a version beyond 0.29.0 where this issue is resolved. Implement rate limiting on prefill requests to prevent resource exhaustion. Monitor and reclaim orphaned transfer placeholders periodically.

Useful 0 Not Useful 0