Home

Description

A vulnerability was found in vllm up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The patch is named 1ad67864c0c20f167929e64c875f5c28e1aad9fd. To fix this issue, it is recommended to deploy a patch.

PUBLISHED Reserved 2026-04-26 | Published 2026-04-27 | Updated 2026-04-27 | Assigner VulDB




MEDIUM: 6.3CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
MEDIUM: 5.6CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
MEDIUM: 5.6CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
5.1AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C

Problem types

Uninitialized Resource

Timeline

2026-04-26:Advisory disclosed
2026-04-26:VulDB entry created
2026-04-26:VulDB entry last update

Credits

Zyz3366 (VulDB User) reporter

References

vuldb.com/vuln/359740 (VDB-359740 | vllm KV Block kv_cache_interface.py has_mamba_layers uninitialized resource) vdb-entry technical-description

vuldb.com/vuln/359740/cti (VDB-359740 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/submit/801297 (Submit #801297 | vllm-project vLLM 0.19.0 Use of Uninitialized Resource) third-party-advisory

github.com/vllm-project/vllm/issues/39146 issue-tracking

github.com/vllm-project/vllm/pull/39283 issue-tracking patch

github.com/vllm-project/vllm/issues/39146 exploit issue-tracking

github.com/...ommit/1ad67864c0c20f167929e64c875f5c28e1aad9fd patch

cve.org (CVE-2026-7141)

nvd.nist.gov (CVE-2026-7141)

Download JSON