This vulnerability in vllm-project vLLM 0.26.0 and 0.27.0 involves the MoRIIO Acknowledgement Handler's functions MoRIIOConnectorScheduler.request_finished, MoRIIOConnectorWorker.get_finished, and MoRIIOWrapper._handle_release_message. By manipulating the arguments request_id or kv_transfer_params, an attacker can cause excessive resource consumption remotely. The issue was reported early via a pull request, but the project has not issued a fix or official response.

An unauthenticated remote attacker can trigger resource consumption in the affected vLLM versions by manipulating specific function arguments. This may degrade system performance or availability but does not indicate privilege escalation, data disclosure, or code execution. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is available and the vendor has not reacted, users should monitor for updates from the vllm-project. Until a fix is released, consider limiting exposure of the affected component to untrusted networks if possible.