vLLM's Mooncake connector up to 0.29.0 fails to manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. This flaw allows an attacker to initiate many completion requests with different prompts, causing orphaned KV cache blocks to accumulate in GPU memory until the process must restart, thereby preventing legitimate requests from being served. The consequence is a denial‑of‑service event that consumes all available GPU memory and disrupts inference workloads.

The affected product is vllm-project’s vllm, versions up to and including 0.29.0. Systems running these versions in any deployment that uses the Mooncake connector for GPU KV cache transfers are vulnerable.

The CVSS score for this vulnerability is 8.7, indicating high severity. EPSS data is not available, and the issue is not currently listed in CISA’s KEV catalog. Attackers can trigger the problem remotely by sending completion requests through the exposed vLLM API; the flaw does not require authentication beyond legitimate access to the service, implying a less restrictive attack vector. The risk is significant for production environments with GPU resources, as the memory exhaustion can lead to repeated restarts and service outages.