CVE-2026-92220 in vLLM
Summary
by MITRE • 09/16/2026
A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_finished/MoRIIOConnectorWorker.get_finished/MoRIIOWrapper._handle_release_message of the file vllm/distributed/kv_transfer/kv_connector/v1/moriio/moriio_connector.py of the component MoRIIO Acknowledgement Handler. Performing a manipulation of the argument request_id/kv_transfer_params results in resource consumption. It is possible to initiate the attack remotely. The project was informed of the problem early through a pull request but has not reacted yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified within vLLM versions 0.26.0 and 0.27.0 resides specifically in the MoRIIO Acknowledgement Handler component, affecting critical functions including MoRIIOConnectorScheduler.request_finished, MoRIIOConnectorWorker.get_finished, and MoRIIOWrapper._handle_release_message located in the file vllm/distributed/kv_transfer/kv_connector/v1/moriio/moriio_connector.py. This flaw is classified as a resource consumption vulnerability that stems from improper handling of input arguments during the request lifecycle management process. The core technical issue involves the manipulation of the request_id and kv_transfer_params parameters, which are passed through these functions to manage distributed key-value cache transfers in large language model inference scenarios. When an attacker provides malformed or excessively crafted values for these parameters, the system fails to properly validate or bound the resulting operations, leading to uncontrolled resource consumption rather than a clean error state or graceful degradation of service.
From a technical perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as well as aspects of CWE-20 Improper Input Validation because the system does not adequately sanitize or verify the structure and size of the incoming request identifiers and transfer parameters before processing them through the distributed communication layers. The impact of exploiting this flaw is primarily a denial-of-service condition where the affected vLLM instance experiences significant degradation in performance due to excessive memory allocation, CPU cycles spent on invalid state transitions, or network bandwidth exhaustion caused by repeated failed or looping acknowledgment attempts. Since vLLM operates as a high-throughput inference engine often deployed in production environments serving multiple concurrent users, such resource exhaustion can quickly cascade into broader service outages for all connected clients relying on the model deployment.
The attack vector is remote and does not require authentication if the affected endpoint is exposed to untrusted networks or if internal services are compromised, making it a significant risk in cloud-native deployments where microservices communicate over insecure channels by default. This aligns with MITRE ATT&CK technique T1496 Resource Hijacking, specifically under sub-techniques involving resource consumption for denial of service. An adversary could leverage this flaw to disrupt availability without needing to execute arbitrary code or escalate privileges, simply by flooding the MoRIIO connector endpoints with carefully crafted requests that trigger the inefficient handling logic in the specified Python functions. The persistence of this issue is compounded by the fact that while the project maintainers were notified via a pull request early on, no patch has been released yet, leaving deployments based on these versions exposed to potential exploitation until an official fix is provided and adopted.
Mitigation strategies for organizations currently running vLLM 0.26.0 or 0.27.0 should focus on immediate network-level controls since a code patch is not yet available. Implementing strict rate limiting at the reverse proxy or load balancer level can help throttle the volume of requests reaching the MoRIIO connector endpoints, thereby reducing the likelihood of triggering resource exhaustion conditions. Additionally, deploying Web Application Firewalls with rules designed to detect anomalous patterns in request_id formats and kv_transfer_params structures may block malformed payloads before they reach the vulnerable application logic. It is also advisable to restrict access to these internal inference service ports using network segmentation policies so that only trusted services can communicate with the vLLM instances, thereby limiting the attack surface for remote exploitation attempts until an upgrade to a patched version becomes feasible.