vLLM EUVD-2026-80771

Exploitation requires vLLM to be serving a reasoning-capable model with the thinking-budget feature active, and the attacker must be an authenticated API client (PR:L) able to set the thinking_token_budget sampling parameter. The quadratic blowup only triggers when generated output lacks the reasoning start/end marker token sequences, so the search cursors never advance and every decode step re-scans the full output. Limiting factors: authentication is required, the non-default thinking-budget/reasoning configuration must be enabled, and impact is capped at partial availability degradation (CPU exhaustion / slowed throughput) rather than a full crash or any data compromise.

This is a genuine but low-severity availability issue, and the vendor CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VA:L) is well-calibrated. The only non-zero impact metric is VA:L (partial availability degradation), so despite the network attack vector and low complexity, the ceiling is CPU-consumption slowdown - not a crash, data loss, or information disclosure. PR:L correctly reflects that the attacker must be an authenticated API client able to set the thinking_token_budget sampling parameter against a reasoning-capable model. No EPSS score is provided, it is not in CISA KEV, and no public exploit code is identified - only a not-yet-merged fix PR exists - so there is no public exploit identified at time of analysis and no evidence of active or automated exploitation. One clear data conflict: the 'Information Disclosure' tag contradicts the CVSS vector - this is a CWE-407 algorithmic-complexity denial-of-service (VC:N, VA:L) with no confidentiality impact. Net: a real but low-priority hardening fix rather than an urgent patch, most relevant to multi-tenant vLLM deployments that expose the thinking-budget feature.

An authenticated client of a vLLM inference endpoint running a reasoning model submits requests that set a thinking_token_budget but generate long outputs containing no reasoning start/end markers. Because the marker-search cursors never advance, each decode step re-scans the entire growing output, driving O(L^2) CPU cost that degrades throughput for all tenants on the server. No public exploit code is identified; the attack needs only crafted-but-valid API requests and no user interaction (AV:N/AC:L).