Description

vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can supply arbitrary remote host and port values in kv_transfer_params to create unreachable peer sessions that retain ZeroMQ sockets until the context quota is exhausted, causing an uncaught ZMQError that crashes EngineCore and stops all inference.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-21T22:17:01.280Z",
  "pubdate": "2026-09-21T22:17:01.280Z",
  "executiveSummary": "The vLLM framework, through version 0.29.0, is susceptible to a denial of service (DoS) vulnerability originating in the P2P KV offloading mechanism.\nThe flaw exists within the OffloadingConnector when utilizing a TieringOffloadingSpec with a peer-to-peer secondary tier.\nBy manipulating kv_transfer_params, an attacker can supply arbitrary remote host and port values to initiate unauthorized or unreachable peer sessions.\nThis leads to the exhaustion of system context quotas due to the accumulation of orphaned ZeroMQ sockets that remain indefinitely open.\nThe resulting state triggers an uncaught ZMQError, which causes the EngineCore to crash, effectively halting all inference operations.\nThe vulnerability requires an attacker to have the ability to influence the configuration parameters of the KV transfer mechanism.\nThe impact is high as it results in a complete service outage, disrupting model serving environments and requiring a manual restart of the vLLM engine.",
  "technicalDetails": "The vulnerability resides in the interaction between the OffloadingConnector and the underlying ZeroMQ transport layer when configured for TieringOffloadingSpec.\nWhen an inference request or configuration update includes crafted kv_transfer_params, the engine attempts to establish a P2P connection to the specified remote host and port.\nThe root cause is a lack of rigorous validation and resource management for these P2P connections; the system fails to verify the reachability or authenticity of the target peer before initializing the communication channel.\nStep-by-step exploitation flow: 1) The attacker transmits a request containing malicious or unreachable target addresses within the kv_transfer_params object. 2) The OffloadingConnector processes these parameters and instantiates multiple ZeroMQ sockets to attempt connections to the attacker-supplied, non-existent or malicious peers. 3) Because the connection attempts are not properly timed out or handled through robust error-handling wrappers, the ZeroMQ sockets remain in an active, resource-retaining state. 4) The continuous accumulation of these leaked sockets exhausts the available context quota managed by the process. 5) Once the maximum threshold is reached, the application encounters an unhandled ZMQError.\nBecause this error propagates to the EngineCore without an adequate recovery mechanism, it results in an immediate and fatal exception, causing the entire vLLM engine process to terminate.\nThis vulnerability is particularly impactful in multi-tenant or distributed environments where users might have limited configuration access but can influence request parameters that propagate to the offloading logic.\nThe lack of authentication for the KV transfer handshake facilitates this exploitation, as the system trusts the provided parameters implicitly, allowing an attacker to force the instantiation of arbitrary network handles.\nAffected versions include all vLLM deployments up to and including 0.29.0 that have explicitly enabled TieringOffloadingSpec with a secondary P2P tier."
}