vLLM: unbounded media download from user-supplied URLs exhausts inference server memory

CVE-2026-37237AI/ML frameworks & servingcurated

Impact

A client that can submit a multimodal request supplies a media URL, and vLLM downloads it with no cap on response size, buffering the whole body in memory. A single request pointed at an arbitrarily large file can drive the server process into the OOM killer, taking down every in-flight request on that replica and the GPU memory it had reserved. On a shared inference tier this is a cheap way for one tenant to knock out a model replica repeatedly, and restarts are not free - the weights have to be reloaded onto the GPU. It also makes the server fetch attacker-chosen URLs, so it doubles as an outbound request primitive from inside the serving network. Availability only per the record.

Who can reach it

Any caller that can submit a multimodal inference request with a media URL. Authentication depends on how the deployment fronts vLLM; vLLM itself does not require it by default.

What to do

The record names no fixed release - it cites vLLM up to and including 0.17.0 as affected and the upstream fix as pull request #36506. Track that PR into a tagged release, then roll replicas. In the meantime, reject or rewrite client-supplied media URLs at the gateway, block the serving pods' outbound egress to anything but a trusted media store, and set memory limits on the pods so a single replica dies instead of the node.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-37237 https://github.com/vllm-project/vllm/pull/36506 https://github.com/vllm-project/vllm/blob/main/vllm/multimodal/inputs.py

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.