CVE-2026-92365: vllm-project vllm DOS Vulnerability

CVE-2026-92365 Overview

CVE-2026-92365 affects the vllm-project vLLM inference engine up to version 0.29.0. The vulnerability resides in the vllm/v1/sample/thinking_budget_state.py file and stems from inefficient algorithmic complexity [CWE-404]. Remote attackers can trigger the flaw over the network without user interaction, degrading the availability of the affected inference service. The maintainers have opened a pull request to address the issue, but it has not yet been merged. Because vLLM powers production large language model (LLM) serving stacks, exploitation can slow or stall model inference workloads that depend on the thinking budget sampling path.

Critical Impact
Remote, low-privilege attackers can invoke costly code paths in vLLM's thinking budget state handler, causing resource exhaustion and degrading inference availability for downstream applications.

Affected Products

vllm-project vLLM versions up to and including 0.29.0
Deployments serving inference through the vllm/v1/sample/thinking_budget_state.py sampling path
LLM applications and gateways that depend on vLLM as their backend inference engine

Discovery Timeline

2026-09-16 - CVE-2026-92365 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92365

Vulnerability Analysis

The flaw is an algorithmic complexity issue categorized under [CWE-404] (Improper Resource Shutdown or Release). Attacker-controlled input drives execution into a code path inside thinking_budget_state.py where the operation cost grows disproportionately to the input size. Because vLLM exposes inference over the network, the entry point is reachable by any authenticated client of the model server. Repeated or crafted requests can consume CPU cycles, memory, or scheduler slots that would otherwise serve legitimate inference traffic.

The vulnerability does not expose confidentiality or integrity of model data. The impact is limited to availability, as the sampling routine can be forced into an expensive execution pattern. This is characteristic of algorithmic complexity denial-of-service issues in Python-based serving frameworks.

Root Cause

The root cause is inefficient state handling within vLLM's thinking budget sampling logic. The code path processes input in a way that does not bound its computational cost against adversarial inputs. When the sampling state is manipulated through crafted inference requests, the routine executes with worse than expected complexity. The proposed fix is tracked in GitHub Pull Request #51133 and awaits maintainer acceptance.

Attack Vector

Exploitation requires network access to a vLLM inference endpoint and low-level privileges such as a valid API token. The attacker submits inference requests whose parameters exercise the vulnerable thinking budget path. No user interaction is required. Sustained requests can degrade or deny service to other tenants of the same vLLM instance.

No verified proof-of-concept exploit code is published. See the VulDB CVE-2026-92365 entry and the vLLM project repository for technical context.

Detection Methods for CVE-2026-92365

Indicators of Compromise

Sustained spikes in CPU utilization on vLLM worker processes without a corresponding rise in completed inference requests.
Growing request queue depth and rising p95/p99 latency on endpoints backed by vLLM 0.29.0 or earlier.
Repeated inference requests from a single client that exercise thinking-budget or reasoning-mode sampling parameters.

Detection Strategies

Instrument the vLLM server with per-request CPU and wall-clock timing, and alert on outlier requests that consume disproportionate scheduler time.
Log full sampling parameters at the API gateway to identify clients submitting anomalous thinking-budget configurations.
Correlate inference latency degradation with source IP and API token to attribute abuse to specific callers.

Monitoring Recommendations

Track vLLM process metrics (CPU, RSS, GPU utilization, queue length) and baseline them per model and per tenant.
Monitor request rate and payload characteristics on /v1/completions and /v1/chat/completions endpoints for volumetric anomalies.
Feed inference gateway and host telemetry into a centralized data lake for cross-source correlation and retention.

How to Mitigate CVE-2026-92365

Immediate Actions Required

Inventory all vLLM deployments and identify instances running version 0.29.0 or earlier.
Restrict network access to vLLM inference endpoints so only authenticated internal services can reach them.
Enforce per-token and per-IP rate limits at the API gateway in front of vLLM to cap abusive request volume.

Patch Information

A fix is proposed in GitHub Pull Request #51133 against the vLLM project and awaits acceptance at the time of publication. Operators should track the pull request and upgrade to the first vLLM release that incorporates the merged patch. Until a released version is available, apply the workarounds below to limit exposure.

Workarounds

Disable or restrict use of the thinking budget sampling path in server configuration if the deployment does not require it.
Enforce strict validation and upper bounds on sampling parameters at an API gateway or middleware layer before requests reach vLLM.
Isolate vLLM workers per tenant or per workload so that resource exhaustion in one instance does not degrade unrelated services.

bash

# Configuration example: gateway-side rate limiting and parameter caps
# Example nginx snippet placed in front of a vLLM inference endpoint
limit_req_zone $binary_remote_addr zone=vllm_rl:10m rate=10r/s;

server {
    listen 8443 ssl;
    location /v1/ {
        limit_req zone=vllm_rl burst=20 nodelay;
        client_max_body_size 64k;
        proxy_read_timeout 15s;
        proxy_pass http://vllm_upstream;
    }
}