CVE-2026-7141

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-7141
A vulnerability was found in vllm up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The patch is named 1ad67864c0c20f167929e64c875f5c28e1aad9fd. To fix this issue, it is recommended to deploy a patch.

5.6 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

5.1 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 4.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/AjAnubolu/vllm/commit/1ad67864c0c20f167929e64c875f5c28e1aad9fd Patch
https://github.com/vllm-project/vllm/issues/39146 Issue Tracking
https://github.com/vllm-project/vllm/issues/39146#issue-4215090365 Issue Tracking
https://github.com/vllm-project/vllm/pull/39283 Issue Tracking Patch
https://vuldb.com/submit/801297 Third Party Advisory VDB Entry
https://vuldb.com/vuln/359740 Third Party Advisory VDB Entry
https://vuldb.com/vuln/359740/cti Permissions Required
Configurations

Configuration 1 (hide)

cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*
History

01 May 2026, 20:30

Type Values Removed Values Added
CPE cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*
First Time Vllm
Vllm vllm
References () https://github.com/AjAnubolu/vllm/commit/1ad67864c0c20f167929e64c875f5c28e1aad9fd - () https://github.com/AjAnubolu/vllm/commit/1ad67864c0c20f167929e64c875f5c28e1aad9fd - Patch
References () https://github.com/vllm-project/vllm/issues/39146 - () https://github.com/vllm-project/vllm/issues/39146 - Issue Tracking
References () https://github.com/vllm-project/vllm/issues/39146#issue-4215090365 - () https://github.com/vllm-project/vllm/issues/39146#issue-4215090365 - Issue Tracking
References () https://github.com/vllm-project/vllm/pull/39283 - () https://github.com/vllm-project/vllm/pull/39283 - Issue Tracking, Patch
References () https://vuldb.com/submit/801297 - () https://vuldb.com/submit/801297 - Third Party Advisory, VDB Entry
References () https://vuldb.com/vuln/359740 - () https://vuldb.com/vuln/359740 - Third Party Advisory, VDB Entry
References () https://vuldb.com/vuln/359740/cti - () https://vuldb.com/vuln/359740/cti - Permissions Required

27 Apr 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-27 17:16

Updated : 2026-06-17 11:01

NVD link : CVE-2026-7141

Mitre link : CVE-2026-7141

CVE.ORG link : CVE-2026-7141

JSON object : View

Products Affected

vllm

  • vllm
CWE
CWE-908

Use of Uninitialized Resource