Database/AI/ML frameworks & serving
vLLM: unbounded media download from user-supplied URLs exhausts inference server memory
Impact
A client that can submit a multimodal request supplies a media URL, and vLLM downloads it with no cap on response size, buffering the whole body in memory. A single request pointed at an arbitrarily large file can drive the server process into the OOM killer, taking down every in-flight request on that replica and the GPU memory it had reserved. On a shared inference tier this is a cheap way for one tenant to knock out a model replica repeatedly, and restarts are not free - the weights have to be reloaded onto the GPU. It also makes the server fetch attacker-chosen URLs, so it doubles as an outbound request primitive from inside the serving network. Availability only per the record.
Who can reach it
Any caller that can submit a multimodal inference request with a media URL. Authentication depends on how the deployment fronts vLLM; vLLM itself does not require it by default.
What to do
The record names no fixed release - it cites vLLM up to and including 0.17.0 as affected and the upstream fix as pull request #36506. Track that PR into a tagged release, then roll replicas. In the meantime, reject or rewrite client-supplied media URLs at the gateway, block the serving pods' outbound egress to anything but a trusted media store, and set memory limits on the pods so a single replica dies instead of the node.
References
Related entries
- vLLM (activation function loading): Assert-based security check bypass, unauthenticatedCVE-2026-41523 · vLLM (activation function loading)High
- NVIDIA Triton Inference Server: missing authorization lets an unauthenticated caller reach protected operationsCVE-2026-47625 · NVIDIA Triton Inference Server for Linux (authorization check)High
- Spring AI: predictable ONNX model cache path lets a local user plant a substitute model fileCVE-2026-47852 · Spring AI (ONNX model cache path)High
- MKP Kubernetes MCP server: unauthenticated log request exhausts server memoryCVE-2026-50125 · MKP (Kubernetes MCP server, get_resource pod-logs subresource)High
- llama.cpp: uncontrolled recursion in JSON-schema-to-grammar conversion crashes the serverCVE-2026-52130 · llama.cpp (common/json-schema-to-grammar.cpp)High
- Ollama (quantization engine): Unauthenticated remote information disclosure — reads and exfiltrates model dataCVE-2026-5757 · Ollama (quantization engine)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.