Vulnpedia
← Search CVEs

CVE-2026-92220

MEDIUM 6.9

Published 2026-09-16 · Last modified 2026-09-16

A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_finished/MoRIIOConnectorWorker.get_finished/MoRIIOWrapper._handle_release_message of the file vllm/distributed/kv_transfer/kv_connector/v1/moriio/moriio_connector.py of the component MoRIIO Acknowledgement Handler. Performing a manipulation of the argument request_id/kv_transfer_params results in resource consumption. It is possible to initiate the attack remotely. The project was informed of the problem early through a pull request but has not reacted yet.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.7%chance of exploitation in 30 days · 53rd percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

6.9CVSS 4.0 · MEDIUM

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityLow

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Vllm Project

Products Vllm

Weakness (CWE)

  • CWE-400: Resource Consumption
  • CWE-404: Denial of Service

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X

References and research data (JSON)

Vendor product assessments

Showing 32 of 347 vendor product statements; 315 omitted. Read the full vendor advisory.

  • registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9@sha256:006fea51fee2672e37e526aa1d0fdd7e6f6f2dcf428fac12a2cc18b5b8ee8e02_s390x as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-storage-initializer-rhel9@sha256%3A006fea51fee2672e37e526aa1d0fdd7e6f6f2dcf428fac12a2cc18b5b8ee8e02?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9&tag=1790958549

    • vendor fix: For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9@sha256:2ab213b45e46bccd7c9287a9b402100d46d25e9e58118ae57864513de58e77ca_ppc64le as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-storage-initializer-rhel9@sha256%3A2ab213b45e46bccd7c9287a9b402100d46d25e9e58118ae57864513de58e77ca?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9&tag=1790958549

    • vendor fix: For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9@sha256:35a57dd79362703b69e563f84d18d2ec31359628a246e3c36b52ece728aa9f21_arm64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-storage-initializer-rhel9@sha256%3A35a57dd79362703b69e563f84d18d2ec31359628a246e3c36b52ece728aa9f21?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9&tag=1790958549

    • vendor fix: For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9@sha256:856c7748eb45dbd190fb16fe90a09546ac8febf2f83e41d8068e8ac759442018_amd64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-storage-initializer-rhel9@sha256%3A856c7748eb45dbd190fb16fe90a09546ac8febf2f83e41d8068e8ac759442018?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9&tag=1790958549

    • vendor fix: For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • rhaii/vllm-cpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cpu-rhel9?repository_url=registry.redhat.io/rhaii/vllm-cpu-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • rhaii/vllm-gaudi-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-gaudi-rhel9?repository_url=registry.redhat.io/rhaii/vllm-gaudi-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • rhaii/vllm-rocm-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-rocm-rhel9?repository_url=registry.redhat.io/rhaii/vllm-rocm-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • rhaii/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-tpu-rhel9?repository_url=registry.redhat.io/rhaii/vllm-tpu-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • rhaiis/vllm-cpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cpu-rhel9?repository_url=registry.redhat.io/rhaiis/vllm-cpu-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • rhaiis/vllm-neuron-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-neuron-rhel9?repository_url=registry.redhat.io/rhaiis/vllm-neuron-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • rhaiis/vllm-spyre-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-spyre-rhel9?repository_url=registry.redhat.io/rhaiis/vllm-spyre-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • rhelai3/bootc-aws-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-aws-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • rhelai3/bootc-azure-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-azure-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • rhelai3/bootc-gaudi-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-gaudi-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-gaudi-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • rhelai3/bootc-gcp-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-gcp-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • rhoai/odh-kserve-agent-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-agent-rhel9?repository_url=registry.redhat.io/rhoai/odh-kserve-agent-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • rhoai/odh-kserve-router-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-router-rhel9?repository_url=registry.redhat.io/rhoai/odh-kserve-router-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • rhoai/odh-vllm-gaudi-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-vllm-gaudi-rhel9?repository_url=registry.redhat.io/rhoai/odh-vllm-gaudi-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9@sha256:1edfd89a924a83901845cd773012a3aeca70c09a2175a87e83351140efc80485_ppc64le as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-ai-gateway-payload-processing-rhel9@sha256%3A1edfd89a924a83901845cd773012a3aeca70c09a2175a87e83351140efc80485?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9&tag=1791860396

    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:ec41ef535f621e901055f49a5e19db851c2f80450e95bab74921a1b15e3d1985_ppc64le as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-data-science-pipelines-argo-argoexec-rhel9@sha256%3Aec41ef535f621e901055f49a5e19db851c2f80450e95bab74921a1b15e3d1985?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9&tag=1791863121

    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel9@sha256:2af57c8f8f90c8cb275c9ae6d498d6fff64a793e3dd3ba57fb5a9c369f6a2845_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-kf-notebook-controller-rhel9@sha256%3A2af57c8f8f90c8cb275c9ae6d498d6fff64a793e3dd3ba57fb5a9c369f6a2845?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel9&tag=1791864414

    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-kube-auth-proxy-rhel9@sha256:401e57977f2ba2cbd7f551852f458c0a81a2fbae03fec8699e9e7fa3963c702a_ppc64le as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-kube-auth-proxy-rhel9@sha256%3A401e57977f2ba2cbd7f551852f458c0a81a2fbae03fec8699e9e7fa3963c702a?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-kube-auth-proxy-rhel9&tag=1791862541

    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-llm-d-inference-scheduler-rhel9@sha256:31b2970302e3659f8a96a79fc5d423a878cfb74844d0351948d22cead52e9d6d_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-llm-d-inference-scheduler-rhel9@sha256%3A31b2970302e3659f8a96a79fc5d423a878cfb74844d0351948d22cead52e9d6d?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-llm-d-inference-scheduler-rhel9&tag=1790958114

    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel9@sha256:1171af13d794a8f9cd498bd0d3d3720cf608e80b5854bd1a23391a7b38116329_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-ml-pipelines-launcher-rhel9@sha256%3A1171af13d794a8f9cd498bd0d3d3720cf608e80b5854bd1a23391a7b38116329?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel9&tag=1791865662

    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-mod-arch-automl-rhel9@sha256:3abbe016571b304ac6f3400713a1ff5261e8d4d6223a4e6e20b987a442c346e4_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-mod-arch-automl-rhel9@sha256%3A3abbe016571b304ac6f3400713a1ff5261e8d4d6223a4e6e20b987a442c346e4?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-mod-arch-automl-rhel9&tag=1791861032

    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-mod-arch-model-registry-rhel9@sha256:b47019a765e9de506d22176b8f4cc7fd353d72cb95944cb0052e9556065c8b8f_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-mod-arch-model-registry-rhel9@sha256%3Ab47019a765e9de506d22176b8f4cc7fd353d72cb95944cb0052e9556065c8b8f?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-mod-arch-model-registry-rhel9&tag=1791860918

    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-model-registry-rhel9@sha256:dd1dbea5e827dbc81338fc5f8b2e8551f196828f1339737f689f6b38f9bc828a_ppc64le as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-model-registry-rhel9@sha256%3Add1dbea5e827dbc81338fc5f8b2e8551f196828f1339737f689f6b38f9bc828a?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-model-registry-rhel9&tag=1791869365

    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9@sha256:ac50ad884d8f694cd5e2dd273a22b744ed9aee0ead433bad061e6e68800939de_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9@sha256%3Aac50ad884d8f694cd5e2dd273a22b744ed9aee0ead433bad061e6e68800939de?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9&tag=1791829658

    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-ta-lmes-job-rhel9@sha256:a6a0c57a602d5a62517c585e0a50daf93f942bbfe6af7f7a19d9e837919bbef2_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-ta-lmes-job-rhel9@sha256%3Aa6a0c57a602d5a62517c585e0a50daf93f942bbfe6af7f7a19d9e837919bbef2?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-ta-lmes-job-rhel9&tag=1791470318

    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9@sha256:a392475d6ebdf59f58a7c5655b0f27012f8d58c2a7bf35a5d7c8d9e567145e1e_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-trustyai-garak-lls-provider-dsp-rhel9@sha256%3Aa392475d6ebdf59f58a7c5655b0f27012f8d58c2a7bf35a5d7c8d9e567145e1e?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9&tag=1791785804

    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256:90dc900ff186b76245d319dbc7ffcbc81e6bed7a859d872513994e7a043afdea_ppc64le as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256%3A90dc900ff186b76245d319dbc7ffcbc81e6bed7a859d872513994e7a043afdea?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9&tag=1791872084

    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00
  • rhoai/odh-th-torch-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-th-torch-cuda-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th-torch-cuda-py312-rhel9

    Red Hat · CVE-2026-92220 · Updated 2026-10-19T11:31:07+00:00

All CVSS metrics

  • MEDIUM 6.9 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
  • MEDIUM 5.3 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R
  • MEDIUM 5.3 v3.0 · CNA Primary
    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R
  • MEDIUM 5 v2.0 · CNA Primary
    AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:UR
  • MEDIUM 6.9 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • MEDIUM 5.3 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  • MEDIUM 5 v2.0 · NVD Secondary
    AV:N/AC:L/Au:N/C:N/I:N/A:P

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS