CVE-2026-105775: vLLM: OOB read in Mamba2 mixer enables remote DoS

MEDIUMCISA: TRACK*

Published October 6, 2026

CISO Take

A low-severity out-of-bounds read in vLLM's Mamba2 mixer (conv_ssm_forward) lets an authenticated remote user crash or degrade an inference server through a crafted completions request. Impact is limited to availability (CVSS 4.3, no confidentiality or integrity loss reported), and the EPSS score of 0.003 (top ~80th percentile) with no KEV listing, no Nuclei template and no confirmed weaponized exploit suggests low near-term exploitation likelihood. However, a public issue (vllm-project/vllm#57266) documents the flaw, vLLM has 95 downstream dependents and 134 other CVEs on record, and the maintainers have not yet responded, so no patch is available. Exposure only matters if you serve Mamba2-based models (e.g., hybrid SSM architectures) on vLLM 0.31.0 or earlier. Restrict inference endpoints to trusted authenticated clients, add request-level rate limiting and automatic restart supervision, and track the upstream issue for a fix.

Sources:NVDEPSSATLASVulDBGitHub (vllm-project/vllm issue #57266)OpenSSF

What is the risk?

Overall risk is LOW to MEDIUM. Exploitation is network-reachable with low complexity and needs only low privileges (a valid API access to the completions endpoint), no user interaction. Impact is limited to availability per the CVSS vector. The exploit details are public in a GitHub issue, but EPSS is low (0.00296), there is no KEV entry, and no weaponized exploit or scanner template exists. No patched version is identified, and the vendor has not responded, which prolongs exposure. Risk rises for multi-tenant or internet-exposed vLLM deployments serving Mamba2-family models. Note that the out-of-bounds read could also in principle leak adjacent memory, but the scoring assigns no confidentiality impact, so treat that as unconfirmed.

How does the attack unfold?

Initial Access

Attacker obtains low-privilege access to an exposed vLLM completions API endpoint.

AML.T0049

Exploitation

A crafted completions request to a Mamba2-based model triggers an out-of-bounds read in conv_ssm_forward.

AML.T0040

Impact

The inference engine crashes or degrades, causing denial of service for all users of the instance.

AML.T0029

Initial Access

Attacker obtains low-privilege access to an exposed vLLM completions API endpoint.

AML.T0049

Exploitation

A crafted completions request to a Mamba2-based model triggers an out-of-bounds read in conv_ssm_forward.

AML.T0040

Impact

The inference engine crashes or degrades, causing denial of service for all users of the instance.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
95.4K94 dependentsPushed 6d ago27% patched~37d to patchFull package profile →
vLLM	pip	—	No patch
95.4K94 dependentsPushed 6d ago27% patched~37d to patchFull package profile →

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

ALow

What should I do?

1 step

1) Inventory vLLM deployments and identify any serving Mamba2 or hybrid SSM models; versions up to 0.31.0 are in scope. 2) No patched version is listed; monitor https://github.com/vllm-project/vllm/issues/57266 and the vLLM release notes, and upgrade as soon as a fix is released. 3) Until then, place vLLM behind an authenticating gateway, restrict access to trusted clients/networks, and enforce per-user rate limits and input-size/sequence-length limits. 4) Run vLLM under a supervisor (Kubernetes, systemd) with health checks and automatic restart, and use redundant replicas to limit outage. 5) Detect: alert on repeated engine worker crashes, segfaults, CUDA errors, or unusual restarts correlated with specific API keys or source IPs; review completions request logs for malformed or abnormal parameters preceding crashes. 6) If feasible, temporarily switch to non-Mamba2 models for exposed, untrusted-user workloads.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSInferenceAPIFrameworkAML.T0029- Denial of AI Service AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM03-Supply ChainLLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-105775?

Is CVE-2026-105775 actively exploited?

No confirmed active exploitation of CVE-2026-105775 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-105775?

1) Inventory vLLM deployments and identify any serving Mamba2 or hybrid SSM models; versions up to 0.31.0 are in scope. 2) No patched version is listed; monitor https://github.com/vllm-project/vllm/issues/57266 and the vLLM release notes, and upgrade as soon as a fix is released. 3) Until then, place vLLM behind an authenticating gateway, restrict access to trusted clients/networks, and enforce per-user rate limits and input-size/sequence-length limits. 4) Run vLLM under a supervisor (Kubernetes, systemd) with health checks and automatic restart, and use redundant replicas to limit outage. 5) Detect: alert on repeated engine worker crashes, segfaults, CUDA errors, or unusual restarts correlated with specific API keys or source IPs; review completions request logs for malformed or abnormal parameters preceding crashes. 6) If feasible, temporarily switch to non-Mamba2 models for exposed, untrusted-user workloads.

What systems are affected by CVE-2026-105775?

This vulnerability affects the following AI/ML architecture patterns: Model serving, LLM inference servers, State-space model (Mamba2) deployments, Hybrid SSM-transformer serving, OpenAI-compatible API gateways.

What is the CVSS score for CVE-2026-105775?

CVE-2026-105775 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

Model servingLLM inference serversState-space model (Mamba2) deploymentsHybrid SSM-transformer servingOpenAI-compatible API gateways

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM10

What are the technical details?

Original Advisory

A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/model_executor/layers/mamba/mamba_mixer2.py of the component Completions Request Handler. The manipulation leads to out-of-bounds read. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker with a low-privilege API key for a company's shared vLLM-backed inference service, or an open endpoint with weak authentication, sends a crafted completions request, based on the details in the public GitHub issue, to a Mamba2-based model. The request triggers an out-of-bounds read in conv_ssm_forward, causing the engine process to crash or behave erratically. By repeating the request, the attacker repeatedly takes down the inference service, disrupting AI-powered applications that depend on it (chat assistants, code completion, internal automation) until the service is restarted or access is blocked.

Weaknesses (CWE)

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferPrimary CWE-125Out-of-bounds ReadPrimary CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125Out-of-bounds Read

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.

Source: MITRE CWE corpus.