{
 "id": "AIR-2026-0156",
 "slug": "vllm-mooncake-connector-gpu-memory-exhaustion-vulnerability",
 "title": "vLLM Mooncake connector GPU memory exhaustion vulnerability",
 "summary": "The vLLM Mooncake connector fails to properly manage GPU KV cache block ownership when concurrent child requests share transfer IDs. Attackers can cause GPU memory exhaustion by accumulating orphaned cache blocks until process restart.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "vLLM"
 ],
 "incident_date": "2026-09-21",
 "incident_date_precision": "day",
 "first_reported": "2026-09-21",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94627",
   "publisher": "NVD",
   "title": "CVE-2026-94627: vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share…",
   "published_at": "2026-09-21"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-94627",
  "vllm",
  "memory_exhaustion"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}