vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps vllm-project/vllm (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for vllm-project/vllm.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Sep 21, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 21, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 21, 2026

Sources and claim methodology

• GitHub security advisorygithub.com
• GitHub security advisorygithub.com
• GitHub security advisorygithub.com
• Source referencevulncheck.com

Related CVEs

• vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer MetadataSame vllm-project/vllm package
• vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion FailureSame vllm-project/vllm package
• vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading SessionsSame vllm-project/vllm package
• vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_sizeSame vllm-project/vllm package
• vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID CollisionSame vllm-project/vllm package
• AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronizationSame generic ecosystem