CVE-2026-92220: A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_
Summary
A vulnerability was found in vLLM versions 0.26.0 and 0.27.0 in the MoRIIO (a distributed key-value transfer component) acknowledgement handler that allows remote attackers to manipulate certain arguments and cause excessive resource consumption (a denial-of-service attack where a system runs out of memory or CPU). The developers were notified through a pull request but have not yet responded or released a fix.
Vulnerability Details
5.3(medium)
EPSS: 0.0%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
network
low
none
none
September 15, 2026
Classification
Affected Vendors
Related Issues
CVE-2026-47482: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory
CVE-2022-29200: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implem
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-92220
First tracked: September 16, 2026 at 02:07 AM
Classified by LLM (prompt v3) · confidence: 85%