PT-2026-35459 · Vllm · Vllm

Zyz3366 · Published 2026-04-27 · Updated 2026-04-27 · CVE-2026-7141

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions vllm versions prior to 0.19.0

Description A flaw in the KV Block Handler component, specifically within the has mamba layers() function of the vllm/v1/kv cache interface.py file, allows for an uninitialized resource through manipulation. This issue can be triggered remotely, although the attack complexity is high and exploitability is difficult.

Recommendations Deploy patch 1ad67864c0c20f167929e64c875f5c28e1aad9fd for versions prior to 0.19.0. As a temporary workaround, restrict access to the has mamba layers() function to minimize the risk of exploitation.

Exploit

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2026-7141

GHSA-X368-4G9H-FVV4

Affected Products

Vllm

References · 11

• 🔥 https://github.com/vllm-project/vllm/issues/39146#issue-4215090365 · Exploit
• https://github.com/vllm-project/vllm/pull/39283 · Patch
• https://github.com/AjAnubolu/vllm/commit/1ad67864c0c20f167929e64c875f5c28e1aad9fd · Patch
• https://osv.dev/vulnerability/GHSA-x368-4g9h-fvv4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7141 · Security Note
• https://github.com/vllm-project/vllm/issues/39146 · Note
• https://twitter.com/CVEnew/status/2048852132812497283 · Twitter Post
• https://t.me/CVEtracker/51969 · Telegram Post
• https://vuldb.com/submit/801297 · Note
• https://vuldb.com/vuln/359740/cti · Note
• https://vuldb.com/vuln/359740 · Note