Skip to content
fr Sign in
8.7 High

CVE-2026-116177 vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated…

Description

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker and deny service to co-tenants.

Affected products and versions

Product Affected versions Fixed in
vllm 0.25 earliest → < 0.25.0 0.25.0
vllm 0.10 0.10.2 → < 0.25.0 0.25.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of vllm

The 121 CVEs of vllm →
CVE-2026-115918 vLLM is an inference and serving engine for large language models 6.5 Medium CVE-2026-115917 vLLM is an inference and serving engine for large language models 3.4 Low CVE-2026-115916 vLLM is an inference and serving engine for large language models 6.5 Medium CVE-2026-115915 vLLM is an inference and serving engine for large language models 8.1 High
Track this CVE