Find a vulnerability
Search criteria
Related vulnerabilities
PYSEC-2026-4184
Vulnerability from pysec - Published: 2026-09-26 14:16 - Updated: 2026-10-07 09:33vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits). Across four ingress paths — the shared media-acquisition layer (HTTPConnection.get_bytes()/async_get_bytes()), the chat completions audio_url/base64 path, the batch speech runner, and the Rust frontend POST /tokenize route — the server reads the entire HTTP response body, base64-decodes the inline payload, or spawns one fetch/decode task per media part, and only then applies the limit (or, on some paths, never applies it). A remote attacker can therefore cause the API server or batch-runner process to allocate memory and consume outbound bandwidth proportional to an attacker-chosen body size or media item count before the request is rejected, resulting in pre-inference memory and bandwidth exhaustion (denial of service). The chat and batch surfaces require an API key when one is configured; the Rust frontend /tokenize route is unauthenticated by design. There is no code execution or data disclosure impact.
| Name | purl | vllm | pkg:pypi/vllm |
|---|
{
"affected": [
{
"ecosystem_specific": {},
"package": {
"ecosystem": "PyPI",
"name": "vllm",
"purl": "pkg:pypi/vllm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.30.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0.1",
"0.1.0",
"0.1.1",
"0.1.2",
"0.1.3",
"0.1.4",
"0.1.5",
"0.1.6",
"0.1.7",
"0.10.0",
"0.10.1",
"0.10.1.1",
"0.10.2",
"0.11.0",
"0.11.1",
"0.11.2",
"0.12.0",
"0.13.0",
"0.14.0",
"0.14.1",
"0.15.0",
"0.15.1",
"0.16.0",
"0.17.0",
"0.17.1",
"0.18.0",
"0.18.1",
"0.19.0",
"0.19.1",
"0.2.0",
"0.2.1",
"0.2.1.post1",
"0.2.2",
"0.2.3",
"0.2.4",
"0.2.5",
"0.2.6",
"0.2.7",
"0.20.0",
"0.20.1",
"0.20.2",
"0.21.0",
"0.22.0",
"0.22.1",
"0.23.0",
"0.24.0",
"0.25.0",
"0.25.1",
"0.26.0",
"0.27.0",
"0.27.1",
"0.28.0",
"0.29.0",
"0.3.0",
"0.3.1",
"0.3.2",
"0.3.3",
"0.4.0",
"0.4.0.post1",
"0.4.1",
"0.4.2",
"0.4.3",
"0.5.0",
"0.5.0.post1",
"0.5.1",
"0.5.2",
"0.5.3",
"0.5.3.post1",
"0.5.4",
"0.5.5",
"0.6.0",
"0.6.1",
"0.6.1.post1",
"0.6.1.post2",
"0.6.2",
"0.6.3",
"0.6.3.post1",
"0.6.4",
"0.6.4.post1",
"0.6.5",
"0.6.6",
"0.6.6.post1",
"0.7.0",
"0.7.1",
"0.7.2",
"0.7.3",
"0.8.0",
"0.8.1",
"0.8.2",
"0.8.3",
"0.8.4",
"0.8.5",
"0.8.5.post1",
"0.9.0",
"0.9.0.1",
"0.9.1",
"0.9.2"
]
}
],
"aliases": [
"CVE-2026-100650",
"GHSA-p6g9-7v3x-m8mv"
],
"details": "vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits). Across four ingress paths \u2014 the shared media-acquisition layer (HTTPConnection.get_bytes()/async_get_bytes()), the chat completions audio_url/base64 path, the batch speech runner, and the Rust frontend POST /tokenize route \u2014 the server reads the entire HTTP response body, base64-decodes the inline payload, or spawns one fetch/decode task per media part, and only then applies the limit (or, on some paths, never applies it). A remote attacker can therefore cause the API server or batch-runner process to allocate memory and consume outbound bandwidth proportional to an attacker-chosen body size or media item count before the request is rejected, resulting in pre-inference memory and bandwidth exhaustion (denial of service). The chat and batch surfaces require an API key when one is configured; the Rust frontend /tokenize route is unauthenticated by design. There is no code execution or data disclosure impact.",
"id": "PYSEC-2026-4184",
"modified": "2026-10-07T09:33:02.743096Z",
"published": "2026-09-26T14:16:47.523Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.vulncheck.com/advisories/vllm-before-0.29.0-resource-exhaustion-via-unbounded-media-materialization"
},
{
"type": "FIX",
"url": "https://github.com/vllm-project/vllm/commit/752a3a504485790a2e8491cacbb35c137339ad34"
},
{
"type": "EVIDENCE",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-p6g9-7v3x-m8mv"
}
],
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}