CVE-2026-92365: vllm-project vllm thinking_budget_state.py algorithmic complexity
A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinkingbudgetstate.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Deployments running vllm-project vllm versions up to 0.29.0 are identified as affected. The available data states that the attack can be launched remotely.
What level of access does an attacker need?
The severity vector indicates that an attacker needs low privileges and does not require user interaction. Attack complexity is rated low.
What is the expected impact if exploited?
The reported impact is limited to availability, caused by inefficient algorithmic complexity. No confidentiality or integrity impact is indicated.
Is a fix available?
A pull request intended to fix the issue exists, but it is awaiting acceptance. The provided information does not identify a released fixed version or a workaround.