CVE-2026-92365

MEDIUM 4.3

vllm-project vllm thinking_budget_state.py algorithmic complexity

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

CWE	CWE-407 CWE-404
Vendor	vllm-project
Product	vllm
Published	Sep 16, 2026

Stay Ahead of the Next One

Get instant alerts for vllm-project vllm

Be the first to know when new medium vulnerabilities affecting vllm-project vllm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

vllm-project / vllm

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 0.10 0.11 0.12 0.13 0.14 0.15 0.16 0.17 0.18 0.19 0.20 0.21 0.22 0.23 0.24 0.25 0.26 0.27 0.28 0.29.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/405451 vuldb.com: https://vuldb.com/vuln/405451/cti vuldb.com: https://vuldb.com/cve/CVE-2026-92365 vuldb.com: https://vuldb.com/submit/935016 github.com: https://github.com/vllm-project/vllm/pull/51133 github.com: https://github.com/vllm-project/vllm/

Credits

🔍 JPengLi (VulDB User) VulDB CNA Team