TI-2026-62256 Aliases CVE-2026-92220 GHSA-72xc-v4m3-9r7g

vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumption

LOW 38CWE-400Published 2026-09-16 · Updated 2026-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_finished/MoRIIOConnectorWorker.get_finished/MoRIIOWrapper._handle_release_message of the file vllm/distributed/kv_transfer/kv_connector/v1/moriio/moriio_connector.py of the component MoRIIO Acknowledgement Handler. Performing a manipulation of the argument request_id/kv_transfer_params results in resource consumption. It is possible to initiate the attack remotely. The project was informed of the problem early through a pull request but has not reacted yet.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00701 53rd percentileScored 2026-11-07

Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
vllm-project	vLLM	0.26.0; 0.27.0	—	No fix listed	CNA

vLLM Vendorvllm-project Affected 0.26.0; 0.27.0 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vllm-project:vllm::::::::	—	—	vllm-project

cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:* Versions — — ·vllm-project

Remediation

Red Hat 1 advisory

RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
RHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat AI Inference Server	Affected	No fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet
Red Hat OpenShift AI 3.4	Fixed	RHSA-2026:84734

Not affected: 2 products

Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift AI 3.4

Timeline

2026-10-02 Threatist record created from CVE-2026-92220
2026-10-03 Alias added: GHSA-72xc-v4m3-9r7g
2026-10-06 Affected versions changed · Red Hat
2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat

References

Patch 1

https://github.com/vllm-project/vllm/pull/50674

Other 1

https://github.com/vllm-project/vllm/

TI-2024-10229 Remote Code Execution in vllm-project/vllm CVSS 3.0CRITICAL 9.8
TI-2024-08404 Remote Code Execution in vllm-project/vllm CVSS 3.1CRITICAL 9.8
TI-2026-36017 vLLM: OpenAI auth bypass CVSS 3.1CRITICAL 9.1
TI-2026-63056 vLLM before 0.28.0 Denial of Service via negative token ID CVSS 4.0HIGH 8.7
TI-2026-04308 Hardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security Control CVSS 3.0HIGH 8.8
TI-2026-39137 vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection CVSS 3.1HIGH 7.5

See all 124 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences