high · CVSS v3 7.5

CVE-2026-114055

The vulnerability in vLLM (versions 0.7.3 through 0.30.x) allows remote clients to supply oversized multimodal processor parameters via mm_p

Overview

The vulnerability in vLLM (versions 0.7.3 through 0.30.x) allows remote clients to supply oversized multimodal processor parameters via mm_processor_kwargs, causing uncontrolled memory consumption and server termination. It affects multimodal processors such as Isaac, InternVL, and H2OVL. The flaw can be exploited to disrupt services that rely on shared vLLM instances.

Description

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server.

Impact

The primary impact is a denial‑of‑service through memory exhaustion, compromising availability. Confidentiality and integrity are not directly affected, but the interruption can delay or halt critical AI inference workloads for affected organizations.

Remediation

Upgrade vLLM to version 0.31.0 or later. If upgrading is not immediately possible, implement input validation to cap mm_processor_kwargs values, enforce strict resource limits (e.g., memory quotas), apply rate limiting on client requests, and monitor memory usage to trigger graceful shutdowns or restarts.

Risk context

Severity is high with a CVSS v3 score of 7.5. Although EPSS data is unavailable, the potential for widespread service disruption warrants prompt mitigation.

Affected products

  • vLLM
  • Isaac
  • InternVL
  • H2OVL

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
—
EPSS
—

vLLM resource-exhaustion denial-of-service multimodal mm_processor_kwargs patch memory-usage

← All CVEs

Related CVEs

high

CVE-2026-114053

vLLM versions 0.7.3 through 0.30.9 allow an attacker to specify a code revision that is loaded by the Transformers AutoProcessor when trust_remote_code is enabled. This can lead to arbitrary Python execution via the unauthenticated /tokenize endpoint. The flaw affects any deployment of vLLM that accepts external model revisions.

View analysis

high

CVE-2026-114059

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.

View analysis

high

CVE-2026-114063

SvelteKit versions 2.10.0 through 2.99.9 expose a path traversal flaw in the Vite preview server on Windows, letting unauthenticated users read arbitrary files outside the prerendered output. The vulnerability can leak source code, configuration, or credentials if the preview server is reachable over the network. It is critical for deployments that expose the preview server to the internet or internal network.

View analysis

high

CVE-2026-114066

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.

View analysis