vLLM: remote media is fully materialized before size and per-prompt limits are enforced

Impact

vLLM through 0.29.0 fetches and fully materializes remote or inline media before applying the compressed-audio size cap and the per-modality item limits. Across four ingress paths the server reads the whole HTTP body, base64-decodes the inline payload, or spawns a fetch/decode task per media part, and only then rejects the request. A caller can force the API server or batch runner to allocate memory and burn outbound bandwidth proportional to a size they choose, exhausting the host before inference even starts, which takes the model replica down on that GPU node. The chat and batch surfaces require an API key when one is configured; the Rust frontend /tokenize route is unauthenticated by design. No code execution or data disclosure.

Who can reach it

Any client that can reach the API - authenticated for the chat and batch paths when a key is set, unauthenticated for the Rust frontend POST /tokenize. The remote-fetch path also lets the attacker point the server at a host they control to size the response.

What to do

Upgrade to vLLM 0.29.0 or later (fix commit 752a3a5) and restart each serving and batch-runner process. Meanwhile, bound request body size at the ingress, restrict or block outbound egress from serving pods so remote media URLs cannot be fetched arbitrarily, and set a memory limit on the pod so one replica cannot take the node with it.

References

Related entries

• vLLM: overlong token_ids on the disaggregated serving endpoint crash the workerCVE-2026-100651 · vLLM (disaggregated serving endpoint /inference/v1/generate, decoder prompt-length validation)High
• vLLM: out-of-range stop_token_ids trigger a CUDA device assertion and wedge EngineCoreCVE-2026-100654 · vLLM (OpenAI-compatible /v1/completions and /v1/chat/completions, stop_token_ids validation)High
• vLLM: malformed IAMF audio upload reaches FFmpeg heap overflow and crashes the inference serverCVE-2026-109311 · vLLM (/v1/audio/transcriptions PyAV/FFmpeg audio decode path)High
• vLLM: forged multimodal uuid desynchronizes the processor cache and kills the serving instanceCVE-2026-114050 · vLLM (multimodal processor cache, client-supplied uuid)High
• vLLM: one request with oversized min_tokens kills the EngineCore input thread while /health stays 200CVE-2026-114051 · vLLM (/inference/v1/generate min_tokens validation, EngineCore input thread)High
• vLLM: caller-controlled EXIF ImageID and cache_salt collide cache keys across requestsCVE-2026-114054 · vLLM (multimodal media cache and prefix KV cache key derivation)High