Description
A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vllm-project | vllm | 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 0.10, 0.11, 0.12, 0.13, 0.14, 0.15, 0.16, 0.17, 0.18, 0.19, 0.20, 0.21, 0.22, 0.23, 0.24, 0.25, 0.26, 0.27, 0.28, 0.29.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-vllm | 0.30.0-1.1 | openSUSE-SU-2026:11867-1 |
Advisories 2
- WID-SEC-2026-3437 vllm: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 27, 2026
- openSUSE-SU-2026:11867-1 python313-vllm-0.30.0-1.1 on GA media SUSE / openSUSE Security Updates · Sep 24, 2026
References
- VDB-405451 | vllm-project vllm thinking_budget_state.py algorithmic complexity vdb-entry
- VDB-405451 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-92365 | CVE Analysis and Report third-party-advisory
- Submit #935016 | vLLM Project vLLM >=0.26.0 Inefficient Algorithmic Complexity third-party-advisory
- https://github.com/vllm-project/vllm/pull/51133 issue-tracking patch
- https://github.com/vllm-project/vllm/ product