Description

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 480 seconds while health checks continue returning success.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-21T22:17:01.433Z",
  "pubdate": "2026-09-21T22:17:01.433Z",
  "executiveSummary": "vLLM versions up to and including 0.29.0 are susceptible to a resource exhaustion vulnerability within the MooncakeConnector component.\nThe flaw stems from improper lifecycle management of transfer placeholders associated with rejected prefill requests, which are permanently leaked rather than reclaimed.\nThis vulnerability allows an unauthenticated attacker to inject a series of specifically crafted, rejected prefill requests into the system, forcing the allocation of orphaned placeholders.\nBy systematically saturating the sender task pools, an attacker can induce significant latency, causing valid client requests to experience delays of up to 480 seconds.\nThe critical impact is a degradation of service availability, as the system effectively enters a state of denial-of-service while internal health check mechanisms continue to report nominal operational status, potentially misleading automated monitoring systems.",
  "technicalDetails": "The vulnerability resides in the MooncakeConnector architecture, specifically within the logic governing the handling of prefill request lifecycle events. When a prefill request is initiated and subsequently rejected, the underlying infrastructure fails to execute the necessary cleanup routines for the associated transfer placeholders.\nUnder normal operating conditions, these placeholders are expected to act as ephemeral synchronization primitives; however, in vLLM 0.29.0 and earlier, these objects persist in an 'ownerless' state, effectively leaking memory and task slot capacity from the global sender task pool.\nThe exploitation flow involves an attacker flooding the MooncakeConnector endpoint with malicious prefill requests designed to trigger rejection. Because each rejection leads to an irrevocable decrement in available task capacity, the cumulative effect is a rapid depletion of the sender task pool.\nAs the task pool reaches exhaustion, the scheduler experiences significant blocking behavior, resulting in severe queueing delays for legitimate workloads. The system exhibits a 'zombie' failure state where health check probes pass, as they often query high-level status markers rather than the health of the internal task scheduler's resource availability.\nThis behavior facilitates a persistent Denial-of-Service (DoS) condition that is difficult for standard monitoring tools to detect immediately, as the orchestration layer perceives the instance as 'Healthy' despite the total failure to process throughput in a timely manner. The 480-second latency window is a result of the scheduler's attempt to wait for available resources that are never returned to the pool, resulting in extended request timeouts and service degradation."
}