CVE-2026-7141
vllm KV Block kv_cache_interface.py has_mamba_layers uninitialized resource
CVSS Score
5.6
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was found in vllm up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The patch is named 1ad67864c0c20f167929e64c875f5c28e1aad9fd. To fix this issue, it is recommended to deploy a patch.
| CWE | CWE-908 |
| Vendor | n/a |
| Product | vllm |
| Published | Apr 27, 2026 |
| Last Updated | Apr 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a vllm
Be the first to know when new medium vulnerabilities affecting n/a vllm are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / vllm
0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 0.10 0.11 0.12 0.13 0.14 0.15 0.16 0.17 0.18 0.19.0
References
vuldb.com: https://vuldb.com/vuln/359740 vuldb.com: https://vuldb.com/vuln/359740/cti vuldb.com: https://vuldb.com/submit/801297 github.com: https://github.com/vllm-project/vllm/issues/39146 github.com: https://github.com/vllm-project/vllm/pull/39283 github.com: https://github.com/vllm-project/vllm/issues/39146#issue-4215090365 github.com: https://github.com/AjAnubolu/vllm/commit/1ad67864c0c20f167929e64c875f5c28e1aad9fd
Credits
🔍 Zyz3366 (VulDB User)