CVE-2026-7141: vllm KV Block kv_cache_interface.py has_mamba_layers uninitialized resource
A vulnerability was found in vllm up to 0.19.0. The affected element is the function hasmambalayers of the file vllm/v1/kvcacheinterface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The patch is named 1ad67864c0c20f167929e64c875f5c28e1aad9fd. To fix this issue, it is recommended to deploy a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vllm (KV Block Handler)to a version that resolves this vulnerability.Fixed in 0.19.0Patch 1ad67864c0c20f167929e64c875f5c28e1aad9fd - Compensating control
Given the exploitability is described as difficult/high-complexity but public, restrict remote access to the vllm KV Block Handler interface/endpoints to trusted networks/hosts (e.g., via firewall/ACL) until the patch is deployed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7141?
CVE-2026-7141 has been classified with a moderate severity due to potential exploitation leading to resource mismanagement.
How do I fix CVE-2026-7141?
To fix CVE-2026-7141, upgrade vllm to version 0.19.1 or higher where the vulnerability has been addressed.
What kind of vulnerability is CVE-2026-7141?
CVE-2026-7141 is a resource initialization vulnerability related to the KV Block Handler in the vllm library.
Which versions of vllm are affected by CVE-2026-7141?
CVE-2026-7141 affects all versions of vllm up to and including 0.19.0.
What component in vllm is vulnerable in CVE-2026-7141?
The vulnerable component in CVE-2026-7141 is the has_mamba_layers function in the kv_cache_interface.py file.