Database/AI/ML frameworks & serving
vLLM: Nemotron-VL processors disable the Pillow decompression-bomb guard, letting one image OOM the worker
Impact
The Nemotron-VL processors set Pillow's Image.MAX_IMAGE_PIXELS to None globally, removing the decompression-bomb limit for the whole process. A single crafted image posted to /v1/chat/completions expands to arbitrary resident memory and the OOM killer takes the worker down. On a GPU node that means the model weights have to be reloaded into HBM, which costs minutes per restart, and in a shared endpoint every co-tenant on that worker loses service. Because the guard is disabled globally, non-Nemotron requests on the same process are affected too.
Who can reach it
Any unauthenticated client that can POST to the vLLM OpenAI-compatible endpoint. No credentials needed.
What to do
Upgrade vLLM to 0.25.0 or later and restart the serving workers (weights reload, so expect a cold start per replica). Where upgrade is not immediate, put a request-size and image-dimension limit in the proxy in front of vLLM and keep the endpoint off untrusted networks.
References
Related entries
- vLLM: clients can override the video frame cap via media_io_kwargs and exhaust API frontend memoryCVE-2026-116179 · vLLM VideoMediaIO.load_base64 (media_io_kwargs num_frames override)High
- llama.cpp rpc-server: oversized RPC message length aborts the process, denying service to all clientsCVE-2026-119052 · llama.cpp ggml-rpc server (rpc-server message length handling)High
- Crawl4AI Docker API: unbounded delay fields let an unauthenticated client exhaust the crawler page poolCVE-2026-119119 · Crawl4AI Docker API server (_clamp_untrusted delay fields)High
- n8n: deprecated code nodes execute JavaScript in the main process, outside task-runner isolationCVE-2026-119408 · n8n (deprecated Function, Function Item and LangChain Code nodes)High
- KubeAI (Ollama engine controller): Injection in `ollamaStartupProbeScript()`CVE-2026-34940 · KubeAI (Ollama engine controller)High
- Flowise: public chatflow endpoints return raw flowData including plaintext API keysCVE-2026-41278 · Flowise (GET /api/v1/public-chatflows/:id and public-chatbotConfig response sanitization)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.