Vulnerability PYSEC-2026-4008
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
8 days ago
September 21, 2026 at 10:17 PM UTC
No summary available
0.0.1 - 0.29.0
0.0.1 - 0.29.0
Details
vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel OOM-kill of the decode worker process.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
8 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-4005
0.0.1 - 0.29.0 PYSEC-2026-4005
Unknown
8 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-4006
0.0.1 - 0.29.0 PYSEC-2026-4006
Unknown
8 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-4007
0.0.1 - 0.29.0 PYSEC-2026-4007
Unknown
8 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-4004
0.0.1 - 0.29.0 PYSEC-2026-4004
Medium Risk
10 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-4000
0.0.1 - 0.29.0 PYSEC-2026-4000
Impacted packages
Timeline
Published
8 days ago
September 21, 2026 at 10:17 PM UTC
Fixed (0.30.0)
8 days ago
September 22, 2026 at 05:23 AM UTC
Last Modified
5 hours ago
September 30, 2026 at 09:15 AM UTC