Vulnerability PYSEC-2026-4004
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
8 days ago
September 21, 2026 at 10:17 PM UTC
No summary available
0.0.1 - 0.29.0
0.0.1 - 0.29.0
Details
vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kv_transfer_params dictionary entries to trigger an uncaught KeyError in EngineCore scheduling, causing the decode engine to terminate and making all routed requests fail until manual restart.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
8 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-4005
0.0.1 - 0.29.0 PYSEC-2026-4005
Unknown
8 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-4006
0.0.1 - 0.29.0 PYSEC-2026-4006
Unknown
8 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-4007
0.0.1 - 0.29.0 PYSEC-2026-4007
Unknown
8 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-4008
0.0.1 - 0.29.0 PYSEC-2026-4008
Medium Risk
10 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-4000
0.0.1 - 0.29.0 PYSEC-2026-4000
Impacted packages
Timeline
Published
8 days ago
September 21, 2026 at 10:17 PM UTC
Fixed (0.30.0)
8 days ago
September 22, 2026 at 05:23 AM UTC
Last Modified
5 hours ago
September 30, 2026 at 09:15 AM UTC