Tools AI Risk Radar ai-incident-0174
Incident record
vLLM requests crash hybrid Mamba2 deployments
- Severity
- Medium
- Status
- Proof-of-concept
- Type
- Infra Vuln
- Target
- vLLM through 0.31.0; hybrid Mamba2, prefix caching and explicit mamba-block-size configuration
- Actor
- researcher
- CVE
- CVE-2026-105775
What happened
A request could trigger an invalid state-buffer access and stop the shared inference engine. The reported configuration uses a hybrid Mamba2 model, prefix caching and an explicit Mamba block size.
The researcher disclosed it on 17 September. The later CVE rates it 4.3 under CVSS 3.1 and 5.3 under CVSS 4.0, both Medium.
Sources
- Primary disclosuregithub.com/vllm-project/vllm/issues/57266
- Supporting advisoryraw.githubusercontent.com/CVEProject/cvelistV5/main/cves/202…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026