Threats tagged 'ghsa-pjfg-w894-9457'

CVE-2026-94627 is a high-severity vulnerability in the vllm-project's vllm software up to version 0.29.0. It involves improper management of GPU KV cache block ownership in concurrent child requests sharing a transfer ID, leading to GPU memory exhaustion. Attackers can cause orphaned KV cache blocks to accumulate by submitting multiple prompts in completion requests, which eventually prevents legitimate requests from executing until the process is restarted.