Database/AI/ML frameworks & serving
vLLM: client-supplied multimodal processor parameters exhaust memory and kill the shared server
Impact
From 0.7.3 up to 0.31.0, vLLM lets a remote client set multimodal processor parameters per request. Large image size, patch count, crop count or frame count values make the processor allocate far beyond what the deployment budgeted, exhausting memory and terminating the server for everyone using it. This is a distinct code path from the MOSS-Audio processor-cache exhaustion (CVE-2026-114052) and affects a much wider version range and several processor families. Operators running one vLLM instance per GPU node for multiple tenants lose the whole instance to a single tenant's request, and the restart pays the model-load cost again.
Who can reach it
Any client that can submit an inference request to the vLLM API - unauthenticated per the advisory vector. Requires the deployment to serve one of the affected multimodal models (Isaac, InternVL, H2OVL and others).
What to do
Upgrade to vLLM 0.31.0 and restart each serving replica (model reload per replica). Before that, do not pass through client-supplied mm_processor_kwargs at any gateway in front of vLLM, and cap request size for multimodal endpoints.
References
Related entries
- KubeAI (Ollama engine controller): Injection in `ollamaStartupProbeScript()`CVE-2026-34940 · KubeAI (Ollama engine controller)High
- Xinference: model launch API executes attacker-supplied Python because trust_remote_code is always onCVE-2026-76841 · Xinference (Xorbits Inference) model loaders - trust_remote_codeHigh
- Coze Studio: any registered user gets code execution from a workflow code node by defaultCVE-2026-77934 · Coze Studio (workflow code node, unsandboxed python3 subprocess)High
- Ollama: model pull follows cross-host redirects, giving SSRF to internal and metadata endpointsCVE-2026-85180 · Ollama (tensor-layer blob download, cross-host redirect handling)High
- Axolotl: multipack patch loads Hugging Face base models with trust_remote_code=True, giving RCE on the training nodeCVE-2026-86169 · Axolotl (multipack patch path, trust_remote_code guard)High
- vLLM: rejected requests leak decode-worker metadata until the worker exhausts memoryCVE-2026-93436 · vLLM NIXL KV connector (decode-side metadata cleanup for rejected requests)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.