CVE-2026-92220

A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_finished/MoRIIOConnectorWorker.get_finished/MoRIIOWrapper._handle_release_message of the file vllm/distributed/kv_transfer/kv_connector/v1/moriio/moriio_connector.py of the component MoRIIO Acknowledgement Handler. Performing a manipulation of the argument request_id/kv_transfer_params results in resource consumption. It is possible to initiate the attack remotely. The project was informed of the problem early through a pull request but has not reacted yet.

• CWE-400
• CWE-404

• https://github.com/vllm-project/vllm/
• https://github.com/vllm-project/vllm/pull/50674
• https://vuldb.com/cve/CVE-2026-92220
• https://vuldb.com/submit/934149
• https://vuldb.com/vuln/404470
• https://vuldb.com/vuln/404470/cti

Published

Sep 16, 2026

Last Modified

Sep 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92213A vulnerability was detected in a2ui-project a2ui up to 0.10…5.5
• CVE-2026-92214A flaw has been found in a2ui-project a2ui up to 0.10.7. Aff…3.5
• CVE-2026-92215A vulnerability has been found in a2ui-project a2ui up to 0.…7.3
• CVE-2026-92216A vulnerability was found in a2ui-project a2ui up to 0.10.7.…4.3
• CVE-2026-92217A vulnerability was determined in a2ui-project a2ui up to 0.…6.3
• CVE-2026-9222Setracker2 Android Companion App com.tgelec.setracker versio…9.2
• CVE-2026-92221A vulnerability was determined in gedelumbung HospitalManage…4.7
• CVE-2026-9223Missing authorization in the vault import feature in Devolut…4.3
• CVE-2026-92234QloApps through 1.7.0 reflects unescaped child feature names…5.4
• CVE-2026-92237Insertion of sensitive information into log file in the slow…6.5
• CVE-2026-92238A maliciously constructed mail header could lead to multiple…
• CVE-2026-92239A maliciously constructed IMAP line could cause an out-of-bo…