An uninitialized resource vulnerability exists in the has_mamba_layers function of the KV Block kv_cache_interface module in vllm (versions up to 0.19.0). By manipulating the input that feeds this function, an attacker can trigger an uninitialized memory state. The vulnerability can be reached remotely and may lead to undefined behavior such as a crash or potential remote code execution, depending on the environment. The CVSS score of 6.3 indicates moderate severity, and the exploit is described as high complexity and difficult.

The issue affects the open‑source vllm project for all releases prior to 0.19.1. The affected component is the KV Block KV Cache Handler located in vllm/v1/kv_cache_interface.py. Systems running 0.19.0 or earlier are therefore vulnerable; newer versions contain the fix.

The risk is moderate due to the CVSS score of 6.3, and the availability of a public exploit combined with high complexity suggests a low‑to‑moderate likelihood of exploitation in the wild. Because the vulnerability is not listed in the CISA KEV catalog and EPSS data is missing, the exact probability is uncertain. Nonetheless, attackers could leverage remote input to trigger the uninitialized state, which may compromise integrity or availability.