CVE-2026-92365: vLLM algorithmic complexity DoS

CISO Take

CVE-2026-92365 is a low-severity denial-of-service flaw in vLLM up to 0.29.0, where the thinking budget state tracking in vllm/v1/sample/thinking_budget_state.py exhibits inefficient algorithmic complexity that an authenticated remote user can trigger. Urgency is low: CVSS is 4.3, EPSS is 0.5% (58th percentile), it is not in CISA KEV, there is no public exploit or Nuclei template, and CISA SSVC rates it TRACK. The impact is availability only, with no confidentiality or integrity loss, but shared multi-tenant inference endpoints could see degraded throughput or latency for all users. The upstream fix (pull request 51133) was still awaiting acceptance at disclosure, so verify its merge status before planning an upgrade. Meanwhile, enforce per-user rate limits and request timeouts, and limit access to reasoning or thinking-budget parameters on exposed vLLM services.

Sources:NVDEPSSATLASCISA SSVCvuldb.comGitHub (vllm-project)

What is the risk?

Low to medium overall. The attack is network-reachable with low complexity, needs only low privileges (an API user) and no user interaction, but the effect is limited to partial availability loss. There is no known exploitation, no public PoC and no KEV listing. Exposure matters most for multi-tenant or internet-facing vLLM endpoints where untrusted users can set thinking-budget-related request parameters. Internal single-tenant deployments carry minimal risk.

How does the attack unfold?

Initial Access

Attacker obtains low-privilege API access to a network-reachable vLLM inference endpoint.

AML.T0040

Exploitation

Attacker sends requests using thinking-budget settings that trigger inefficient algorithmic complexity in thinking_budget_state.py.

AML.T0034.001

Impact

Sampling path slows, throughput drops and queue latency rises, denying service to legitimate users.

AML.T0029

Initial Access

Attacker obtains low-privilege API access to a network-reachable vLLM inference endpoint.

AML.T0040

Exploitation

Attacker sends requests using thinking-budget settings that trigger inefficient algorithmic complexity in thinking_budget_state.py.

AML.T0034.001

Impact

Sampling path slows, throughput drops and queue latency rises, denying service to legitimate users.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
96.0K94 dependentsPushed 5d ago27% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

ALow

What should I do?

1 step

1) Track upstream pull request 51133 and the vLLM release notes, then upgrade to the first release above 0.29.0 that includes the fix once it is merged. 2) Until then, restrict access to vLLM endpoints to authenticated, trusted clients and place them behind an API gateway with per-key rate limits, concurrency caps and request timeouts. 3) Where feasible, disable or cap thinking-budget and reasoning-related request parameters, and bound max tokens and input sizes. 4) Monitor for spikes in per-request latency, GPU or CPU saturation, queue depth and time-to-first-token, and alert on single clients that drive outliers. 5) Configure autoscaling and health checks so a degraded replica is recycled.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSInferenceFrameworkAML.T0029- Denial of AI Service AML.T0034.001- Resource-Intensive Queries AML.T0040- AI Model Inference API Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM10:2025-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-92365?

CVE-2026-92365 is a low-severity denial-of-service flaw in vLLM up to 0.29.0, where the thinking budget state tracking in vllm/v1/sample/thinking_budget_state.py exhibits inefficient algorithmic complexity that an authenticated remote user can trigger. Urgency is low: CVSS is 4.3, EPSS is 0.5% (58th percentile), it is not in CISA KEV, there is no public exploit or Nuclei template, and CISA SSVC rates it TRACK. The impact is availability only, with no confidentiality or integrity loss, but shared multi-tenant inference endpoints could see degraded throughput or latency for all users. The upstream fix (pull request 51133) was still awaiting acceptance at disclosure, so verify its merge status before planning an upgrade. Meanwhile, enforce per-user rate limits and request timeouts, and limit access to reasoning or thinking-budget parameters on exposed vLLM services.

Is CVE-2026-92365 actively exploited?

No confirmed active exploitation of CVE-2026-92365 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-92365?

1) Track upstream pull request 51133 and the vLLM release notes, then upgrade to the first release above 0.29.0 that includes the fix once it is merged. 2) Until then, restrict access to vLLM endpoints to authenticated, trusted clients and place them behind an API gateway with per-key rate limits, concurrency caps and request timeouts. 3) Where feasible, disable or cap thinking-budget and reasoning-related request parameters, and bound max tokens and input sizes. 4) Monitor for spikes in per-request latency, GPU or CPU saturation, queue depth and time-to-first-token, and alert on single clients that drive outliers. 5) Configure autoscaling and health checks so a degraded replica is recycled.

What systems are affected by CVE-2026-92365?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference, reasoning model deployments, multi-tenant inference APIs.

What is the CVSS score for CVE-2026-92365?

CVE-2026-92365 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.52%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inferencereasoning model deploymentsmulti-tenant inference APIs

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0034.001Resource-Intensive Queries

AML.T0040AI Model Inference API Access

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

Exploitation Scenario

An attacker with a low-privilege API key on a shared vLLM inference service sends repeated requests that use the thinking budget feature with crafted parameters or inputs that trigger the inefficient algorithm in thinking_budget_state.py. Each request consumes disproportionate processing time in the sampling path, so the engine's throughput drops and queue latency rises. Legitimate users and downstream applications experience timeouts and degraded service until the attacker is rate-limited or blocked.

Weaknesses (CWE)

CWE-404Improper Resource Shutdown or ReleasePrimary CWE-407Inefficient Algorithmic ComplexityPrimary CWE-404Improper Resource Shutdown or Release CWE-407Inefficient Algorithmic Complexity

CWE-404 — Improper Resource Shutdown or Release: The product does not release or incorrectly releases a resource before it is made available for re-use.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
[Implementation] It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.

Source: MITRE CWE corpus.