CVE-2026-94623: vLLM denial of service in NIXL prefix caching

Executive brief

vLLM is an inference engine for large language models. In disaggregated deployments where prefill and decode operations are split across workers, a vulnerability in the NIXL connector's prefix caching allows attackers to crash the decode worker by sending multiple completion requests with varying prompt lengths, causing service unavailability until restart.

Technical details

The vulnerability is an assertion failure in NixlBaseConnectorWorker._apply_prefix_caching that fails to validate block counts correctly across multi-prompt completion requests in prefill/decode disaggregated deployments. An unauthenticated network attacker can submit specially crafted completion requests to trigger this failure, forcing the decode worker to terminate. No authentication or user interaction is required beyond sending inference requests to the service.

Affected products

• vLLM Project vLLM through 0.29.0

Timeline

• 2026-09-21: disclosed

References

• https://github.com/vllm-project/vllm
• https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/nixl/base_worker.py