CVE-2026-92220: vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumption
A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.requestfinished/MoRIIOConnectorWorker.getfinished/MoRIIOWrapper.handlereleasemessage of the file vllm/distributed/kvtransfer/kvconnector/v1/moriio/moriioconnector.py of the component MoRIIO Acknowledgement Handler. Performing a manipulation of the argument requestid/kvtransferparams results in resource consumption. It is possible to initiate the attack remotely. The project was informed of the problem early through a pull request but has not reacted yet.
Affected Software
Event History
Frequently Asked Questions
Which versions are identified as affected?
The affected versions listed are vLLM 0.26.0 and 0.27.0.
Does exploitation require authentication or user interaction?
The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the reported security impact?
The reported impact is resource consumption affecting availability. No confidentiality or integrity impact is indicated in the supplied severity vector.
Is a fix available from the project?
The project was reportedly informed through a pull request, but had not reacted at the time of the supplied information.