Skip to content
fr Sign in
8.7 High

CVE-2026-114055 vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients…

Description

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server.

Affected products and versions

Product Affected versions Fixed in
vllm 0.31 earliest → < 0.31.0 0.31.0
vllm 0.7 0.7.3 → < 0.31.0 0.31.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of vllm

The 121 CVEs of vllm →
CVE-2026-115918 vLLM is an inference and serving engine for large language models 6.5 Medium CVE-2026-115917 vLLM is an inference and serving engine for large language models 3.4 Low CVE-2026-115916 vLLM is an inference and serving engine for large language models 6.5 Medium CVE-2026-115915 vLLM is an inference and serving engine for large language models 8.1 High
Track this CVE