CVE-2026-93436: vLLM Memory Exhaustion Vulnerability Due to Improper Metadata Cleanup
Summary
CVE-2026-93436: vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Affects vllm versions < 0.30.0. Fixed in 0.30.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vLLM is an open-source library designed for efficient and scalable inference in machine learning models. It allows for disaggregated deployments, where the decoding and pre-filling processes can be handled separately. This architecture is beneficial for resource management and scalability, but it also introduces certain vulnerabilities if not properly managed.
Vulnerability Detail
The vulnerability arises from vLLM versions up to 0.29.0, which fail to adequately clean up decode-side metadata for rejected inference requests. This oversight allows remote attackers to exploit the system by submitting requests with max_tokens set to 0. As a result, the decode-worker's memory can be exhausted indefinitely, leading to potential service disruptions as the worker may need to restart frequently. This vulnerability poses a significant risk, especially in production environments where uptime and resource management are critical.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "vllm==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.30.0
This is the first release that contains the fix.
pip install --upgrade "vllm==0.30.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement rate limiting on the inference requests to prevent excessive submissions with max_tokens=0. This can help mitigate the risk until the package is updated.
Conclusion
The vLLM package has a critical vulnerability that allows for memory exhaustion through improper handling of inference requests. Users are strongly advised to upgrade to version 0.30.0 or later to mitigate this risk. Additionally, implementing rate limiting can serve as a temporary workaround until the upgrade is completed.
See every vulnerability recorded for vllm →
FAQ
The vulnerability can lead to memory exhaustion in decode-workers, causing them to restart frequently and potentially disrupting service availability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of vLLM up to and including 0.29.0 are affected by this vulnerability.
Yes, the vulnerability has been patched in version 0.30.0 of vLLM. It is recommended to upgrade to this version.
If an immediate upgrade is not possible, consider implementing rate limiting on inference requests to mitigate the risk of memory exhaustion.
Related vulnerabilities
Recent vulnerabilities recorded for vllm.
