This vulnerability affects the vllm project versions up to 0.19.0 in the function has_mamba_layers located in vllm/v1/kv_cache_interface.py. The flaw is due to an uninitialized resource that can be manipulated remotely. The attack complexity is high, and no privileges or user interaction are required. The vulnerability has a CVSS 4.0 base score of 6.3, indicating medium severity. Although an exploit is publicly available, exploitation is considered difficult. A patch exists (commit 1ad67864c0c20f167929e64c875f5c28e1aad9fd) to fix the issue.

Successful exploitation could lead to improper handling of uninitialized resources in the KV Block Handler, potentially causing unexpected behavior or resource misuse. The vulnerability does not require privileges or user interaction but has high attack complexity and low impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

A patch identified by commit 1ad67864c0c20f167929e64c875f5c28e1aad9fd is available and should be deployed to remediate this vulnerability. Since the vendor advisory or official remediation level is not explicitly provided, users should verify the patch status with the official vllm project repository or vendor advisory before deployment.