CVE-2026-92220: vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumption

Vulnerability summary

CVE-2026-92220 is a medium (CVSS 6.9) Uncontrolled Resource Consumption vulnerability in vllm-project vllm. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.6% of scored vulnerabilities.

Timeline

1. 16-09-2026
   PublishedVulnerability first disclosed.
2. 16-09-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_finished/MoRIIOConnectorWorker.get_finished/MoRIIOWrapper._handle_release_message of the file vllm/distributed/kv_transfer/kv_connector/v1/moriio/moriio_connector.py of the component MoRIIO Acknowledgement Handler. Performing a manipulation of the argument request_id/kv_transfer_params results in resource consumption. It is possible to initiate the attack remotely. The project was informed of the problem early through a pull request but has not reacted yet.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.