Read the docs
TI-2026-06264 Aliases CVE-2026-7141GHSA-x368-4g9h-fvv4

vLLM KV Block kv_cache_interface.py has_mamba_layers uninitialized resource

Priority MEDIUM 61CWE-908Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A vulnerability was found in vLLM up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The existence of this vulnerability is still disputed at present. The proposed patch did not fix the issue. A 3rd party explains: "The divergence could be explained by a benign and expected vLLM behavior where vLLM server could group concurrent requests together resulting in different input shapes based on varying request arrival time. The differences in grouped input shapes could call different kernels with could produce difference results due to rounding and differences in order of operations. There is an environment variable VLLM_BATCH_INVARIANT=1 for users that desire to have deterministic output with temperature 0.0."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00289 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Partial vllm (PyPI): 0.19.1Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—vLLM0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11; 0.12; 0.13; 0.14; 0.15; 0.16; 0.17; 0.18; 0.19.0—No fix listedCNA
—vllm (PyPI)before 0.19.10.19.1Patch availableGHSA-x368-4g9h-fvv4
  • vLLM Vendor— Affected 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11; 0.12; 0.13; 0.14; 0.15; 0.16; 0.17; 0.18; 0.19.0 Fixed in — No fix listed CNA
  • vllm (PyPI) Vendor— Affected before 0.19.1 Fixed in 0.19.1 Patch available GHSA-x368-4g9h-fvv4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*up to 0.19.0VulnerablevLLM
  • cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:* Versions up to 0.19.0 Vulnerable ·vLLM

Remediation

  • Fix · GHSA-x368-4g9h-fvv4 vllm (PyPI) Fixed in 0.19.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AI Inference ServerAffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7141
  2. 2026-10-03 Alias added: GHSA-x368-4g9h-fvv4

References

Exploit 1

Advisory 1

Other 3

  • TI-2024-10229 Remote Code Execution in vllm-project/vllm CVSS 3.0CRITICAL 9.8
  • TI-2026-36017 vLLM: OpenAI auth bypass CVSS 3.1CRITICAL 9.1
  • TI-2026-63056 vLLM before 0.28.0 Denial of Service via negative token ID CVSS 4.0HIGH 8.7
  • TI-2026-39137 vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection CVSS 3.1HIGH 7.5
  • TI-2026-04816 Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm CVSS 3.0HIGH 7.5
  • TI-2026-65616 vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service CVSS 4.0MEDIUM 6.9
See all 118 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences