Vulnerability PYSEC-2026-4007
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
8 days ago
September 21, 2026 at 10:17 PM UTC
No summary available
0.0.1 - 0.29.0
0.0.1 - 0.29.0
Details
vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 480 seconds while health checks continue returning success.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
8 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-4005
0.0.1 - 0.29.0 PYSEC-2026-4005
Unknown
8 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-4006
0.0.1 - 0.29.0 PYSEC-2026-4006
Unknown
8 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-4008
0.0.1 - 0.29.0 PYSEC-2026-4008
Unknown
8 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-4004
0.0.1 - 0.29.0 PYSEC-2026-4004
Medium Risk
10 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-4000
0.0.1 - 0.29.0 PYSEC-2026-4000
Impacted packages
Timeline
Published
8 days ago
September 21, 2026 at 10:17 PM UTC
Fixed (0.30.0)
8 days ago
September 22, 2026 at 05:23 AM UTC
Last Modified
5 hours ago
September 30, 2026 at 09:15 AM UTC