vLLM’s Mooncake connector, up to version 0.29.0, fails to properly manage ownership of GPU KV cache blocks when multiple completion requests share a single transfer ID during prefill/decode disaggregated deployments. The flaw allows an attacker to trigger an accumulation of orphaned KV cache blocks, exhausting GPU memory until the inference process must restart, thereby preventing legitimate inference requests from being served. This is a classic memory‑leak issue (CWE‑401) that leads to a denial‑of‑service outcome. The description indicates that the vulnerability arises from improper resource cleanup (CWE‑772) during concurrent child requests.

The affected product is the official vllm project, versions 0.29.0 and earlier. Any deployment that uses the Mooncake connector for GPU KV cache transfers is vulnerable. No specific operating system or GPU vendor is mandated by the description, so any GPU‑enabled system running these versions of vllm with the connector will be impacted.

The CVSS score of 8.7 indicates high severity. The EPSS score of < 1% signals a very low but nonzero likelihood of exploitation at the time of analysis. The vulnerability is not yet listed in CISA’s KEV catalog. Attackers can trigger the denial‑of‑service path by sending legitimate completion requests to the exposed vLLM API. Based on the description, it is inferred that authentication is not explicitly required; the flaw can be triggered with normal clients possessing API access, implying a less restrictive attack vector. The risk is consequential for production environments with shared GPU resources, as the exhaustion can cause repeated restarts and prolonged outages.