{
 "id": "AIR-2026-0155",
 "slug": "vllm-p2p-kv-offloading-denial-of-service-vulnerability",
 "title": "vLLM P2P KV offloading denial of service vulnerability",
 "summary": "A denial of service vulnerability in vLLM P2P KV offloading allows supplying arbitrary remote host and port values to exhaust ZeroMQ sockets. This triggers an uncaught ZMQError that crashes EngineCore and stops all inference.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "vLLM"
 ],
 "incident_date": "2026-09-21",
 "incident_date_precision": "day",
 "first_reported": "2026-09-21",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94624",
   "publisher": "NVD",
   "title": "CVE-2026-94624: vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with…",
   "published_at": "2026-09-21"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-94624",
  "vllm",
  "denial_of_service"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}