CVE-2026-92365

Wednesday, September 16, 2026

5.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X

Summary

A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

Affected Software

Vendor	Product	Version Range	Status
vllm-project	vllm	`0.1`	affected
vllm-project	vllm	`0.2`	affected
vllm-project	vllm	`0.3`	affected
vllm-project	vllm	`0.4`	affected
vllm-project	vllm	`0.5`	affected
vllm-project	vllm	`0.6`	affected
vllm-project	vllm	`0.7`	affected
vllm-project	vllm	`0.8`	affected
vllm-project	vllm	`0.9`	affected
vllm-project	vllm	`0.10`	affected
vllm-project	vllm	`0.11`	affected
vllm-project	vllm	`0.12`	affected
vllm-project	vllm	`0.13`	affected
vllm-project	vllm	`0.14`	affected
vllm-project	vllm	`0.15`	affected
vllm-project	vllm	`0.16`	affected
vllm-project	vllm	`0.17`	affected
vllm-project	vllm	`0.18`	affected
vllm-project	vllm	`0.19`	affected
vllm-project	vllm	`0.20`	affected
vllm-project	vllm	`0.21`	affected
vllm-project	vllm	`0.22`	affected
vllm-project	vllm	`0.23`	affected
vllm-project	vllm	`0.24`	affected
vllm-project	vllm	`0.25`	affected
vllm-project	vllm	`0.26`	affected
vllm-project	vllm	`0.27`	affected
vllm-project	vllm	`0.28`	affected
vllm-project	vllm	`0.29.0`	affected

Weaknesses

CWE-407: Inefficient Algorithmic Complexity
CWE-404: Denial of Service

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.