GPU VulnDB

Database/AI/ML frameworks & serving

vLLM: unbounded max_patches in Cohere2 Vision requests exhausts preprocessing workers

CVSS 8.7CVE-2026-126397AI/ML frameworks & servingcurated

Impact

vLLM passes the request's mm_processor_kwargs.max_patches value straight to the Hugging Face processor for Cohere2 Vision models with no server-side cap, and preprocessing cost grows quadratically with that value. Small image chat-completion requests with large, varying max_patches values get past the LRU cache and tie up the CPU preprocessing workers. Every other client of that endpoint is starved, so the GPUs behind it sit idle while the CPU work runs. This is availability only. No data exposure or code execution is described.

Who can reach it

Any client that can send chat-completion requests to a vLLM endpoint serving a Cohere2 Vision model. vLLM's API needs no authentication unless the operator puts one in front of it.

What to do

Upgrade vLLM to 0.31.0 or later and restart the serving processes. This affects only deployments serving Cohere2 Vision models on 0.10.1 through 0.30.x. Until you upgrade, a gateway in front of vLLM can drop or cap mm_processor_kwargs from untrusted clients.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-126397https://github.com/vllm-project/vllm/security/advisories/GHSA-9g3c-x747-c6wrhttps://github.com/vllm-project/vllm/commit/f6326f53bda46898a331c2d24500332c285d9a2bhttps://www.vulncheck.com/advisories/vllm-0.10.1-before-0.31.0-cohere2-vision-dos-via-max-patches

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.