CVE-2026-92365: vllm-project vllm thinking_budget_state.py algorithmic complexity

Vulnerability summary

CVE-2026-92365 is a medium (CVSS 5.3) Improper Resource Shutdown or Release vulnerability in vllm-project vllm. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.3% of scored vulnerabilities.

Timeline

1. 16-09-2026
   PublishedVulnerability first disclosed.
2. 22-09-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

• CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.
• CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.