Algorithmic Complexity Vulnerability in vllm Project Software
CVE-2026-92365

5.3MEDIUM

Key Information:

Vendor

Vllm-project

Status
Vllm
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92365?

A security vulnerability exists in vllm Project's software, specifically in the file vllm/v1/sample/thinking_budget_state.py, which leads to inefficient algorithmic complexity. This flaw may be exploited remotely, potentially causing significant performance degradation. The issue is currently under review for a pull request to address and resolve it.

Affected Version(s)

vllm 0.1

vllm 0.2

vllm 0.3

References

https://vuldb.com/vuln/405451
vdb-entry
https://vuldb.com/vuln/405451/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92365
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

JPengLi (VulDB User)
VulDB CNA Team
.