CVE-2026-94622 affects vLLM versions through 0.29.0. The vulnerability arises in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Specifically, if an attacker sends requests with incomplete kv_transfer_params dictionary entries, an uncaught KeyError is triggered in the EngineCore scheduling component. This exception causes the decode engine to terminate unexpectedly, resulting in a denial of service where all routed requests fail until the service is manually restarted.

Successful exploitation causes a denial of service by terminating the decode engine, disrupting all routed requests until manual intervention restarts the service. There is no indication of privilege escalation, data disclosure, or code execution. The impact is limited to service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor for malformed requests with incomplete kv_transfer_params and consider implementing input validation or request filtering to prevent triggering the uncaught exception. Manual restart of the decode engine is required after an incident.