CVE-2026-93436: Vllm

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max_tokens=0 to exhaust decode-worker memory without bound until the worker restarts.

Affected products

• Vllm Vllm: up to and including 0.29.0

Published 2026-09-17. Last modified 2026-09-28.