CVE-2026-92365CWE-404CWE-407

CVE-2026-92365

Medium · published September 16, 2026

CVSS v3.1
4.3
EPSS
1%
Percentile
43.4
In the wild
Unconfirmed
What it is

A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00521 · 43.4th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-407 · Inefficient Algorithmic Complexity
Published
2026-09-16T18:17Z
References (6)
https://github.com/vllm-project/vllm/ · [email protected]https://github.com/vllm-project/vllm/pull/51133 · [email protected]https://vuldb.com/cve/CVE-2026-92365 · [email protected]https://vuldb.com/submit/935016 · [email protected]https://vuldb.com/vuln/405451 · [email protected]https://vuldb.com/vuln/405451/cti · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 14:00Z
    vllm-project vllm thinking_budget_state.py algorithmic complexity
    cvelistv5