What is CVE-2026-92365?

CVE-2026-92365 is a medium-severity vulnerability in Vllm-Project Vllm, classified under Improper Resource Shutdown or Release. CVSS score: 4.3/10. Published 2026-09-16.

How severe is CVE-2026-92365?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Vllm-Project Vllm

CVE-2026-92365

A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.

Affected products

Vllm-project Vllm — versions 0.1, 0.10, 0.11

Weakness classification (CWE)

References

cna@vuldb.com (product)
cna@vuldb.com (issue-tracking, patch)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (vdb-entry)
cna@vuldb.com (signature, permissions-required)

Frequently asked questions

What is CVE-2026-92365?: CVE-2026-92365 is a medium-severity vulnerability in Vllm-Project Vllm, classified under Improper Resource Shutdown or Release. CVSS score: 4.3/10. Published 2026-09-16.
How severe is CVE-2026-92365?: Medium severity. CVSS v3 base score is 4.3 out of 10.