Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-94623 – Denial of Service (Reachable Assertion) – vLLM ≤ 0.29.0 (NIXL Connector)

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-94623 is a denial-of-service vulnerability in vLLM’s NIXL connector, used for prefill/decode disaggregated deployments. Improper validation of KV-cache block counts across multi-prompt completion requests allows a remote, unauthenticated attacker to trigger a reachable assertion failure that crashes the decode worker process. The flaw carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High).

Technical details

  • Root cause: In prefill/decode disaggregated deployments using the NIXL KV-transfer connector, the router forwards a single KV descriptor for a multi-prompt /v1/completions request. The _apply_prefix_caching logic in NixlBaseConnectorWorker does not correctly validate block counts when prompts of differing lengths are present, relying on bare assert statements instead of handled exceptions.
  • Trigger conditions: An attacker sends a completion request containing multiple prompts of varying token lengths, along with kv_transfer_params, to a vLLM deployment running with prefill/decode disaggregation over the NIXL connector.
  • Attack vector: Network (AV:N), low attack complexity, no privileges or user interaction required — the request can be sent directly to the exposed inference API endpoint.
  • Impact: The assertion failure terminates the decode worker process, causing denial of service for the affected inference deployment. There is no confidentiality or integrity impact; availability impact is high, and recovery requires the worker to be restarted.

Affected software

  • vllm-project vLLM, versions up to and including 0.29.0, when deployed with prefill/decode disaggregation using the NIXL connector

Severity

  • CVSS v3.1 Base Score: 7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVSS v4.0 Score: 8.7 (High) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • CWE-617: Reachable Assertion

Mitigation and recommended actions

  • Immediate: A fix (tracked under GHSA-6vh8-5j8f-m4vf and GitHub PR #51505) rejects multi-prompt requests carrying kv_transfer_params with an HTTP 400 response, and replaces the vulnerable bare assert statements with handled ValueError exceptions so individual malformed requests fail gracefully instead of crashing the worker. Organizations should upgrade to a vLLM release that includes this fix once it is published and confirm the patch level with the vllm-project maintainers, as the fix was still pending final merge and release assignment at time of disclosure.
  • If no patch is yet available for your deployed version:
    • Restrict network access to vLLM inference API endpoints (especially decode-worker endpoints in prefill/decode disaggregated setups) to trusted clients only, using authentication, network segmentation, or an API gateway.
    • Apply request-shape validation or a proxy-layer rule to block/reject multi-prompt completion requests that include kv_transfer_params.
    • Monitor for decode-worker crashes/restarts, reachable-assertion errors, and unusual bursts of multi-prompt requests with varying prompt lengths as an indicator of exploitation attempts.
    • Consider disabling prefill/decode disaggregation via the NIXL connector until the fix is deployed, if feasible for your workload.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge