Vulnerability-Lookup

GHSA-GX7P-2J49-HFQ4

Vulnerability from github – Published: 2026-10-23 20:58 – Updated: 2026-10-23 20:58

Summary

vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)

Details

Summary

API clients can supply arbitrary mm_processor_kwargs per request. vLLM forwards these values through the multimodal rendering and processing pipeline to Hugging Face and custom image/video processor constructors and calls. Resource-sensitive values such as image size, patch size, patch count, crop count, or frame count can therefore be controlled by a remote client.

For processors that upscale inputs, a single request can force an allocation large enough to terminate the API server or worker with an out-of-memory condition.

Affected Components

The per-request field was introduced in commit 041e29471671a3d43afedb6a749421d56ef4d3e7 and first shipped in v0.7.3. The generic forwarding path remains present in current main.

The Isaac path is a concrete high-amplification example:

ChatCompletionRequest.mm_processor_kwargs
OnlineRenderer request extras
MMProcessorInputs.hf_processor_mm_kwargs
BaseMultiModalProcessor.info.get_hf_processor(**hf_processor_mm_kwargs)
IsaacProcessingInfo.get_image_processor(**kwargs)
IsaacImageProcessor(**kwargs)
process_vision_for_patches()

Equivalent constructor forwarding exists in InternVL-derived processors, H2OVL, Step3VL, NemotronVL, and other multimodal processors. The issue is at the shared remote-input boundary and is not limited to a fixed model list.

Impact

Availability: one request can exhaust CPU or GPU memory and terminate a shared service process.
Scope: all users of the affected service instance lose availability.
Authentication: vLLM's API key is optional, so deployments without an external authentication layer are remotely reachable without privileges.

Remediation

Reject non-empty per-request mm_processor_kwargs at every API-server request schema by default. Operators serving only trusted clients can explicitly opt in to the existing override behavior. Server-level --mm-processor-kwargs and offline LLM overrides remain available.

This shared boundary covers current and future multimodal processors instead of maintaining a model-specific list or a denylist that can miss custom processor arguments.

A patch for this was merged here: https://github.com/vllm-project/vllm/pull/58830

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vllm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.7.3"
            },
            {
              "fixed": "0.31.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-114055"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-23T20:58:36Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nAPI clients can supply arbitrary `mm_processor_kwargs` per request. vLLM\nforwards these values through the multimodal rendering and processing pipeline\nto Hugging Face and custom image/video processor constructors and calls.\nResource-sensitive values such as image size, patch size, patch count, crop\ncount, or frame count can therefore be controlled by a remote client.\n\nFor processors that upscale inputs, a single request can force an allocation\nlarge enough to terminate the API server or worker with an out-of-memory\ncondition.\n\n## Affected Components\n\nThe per-request field was introduced in commit\n`041e29471671a3d43afedb6a749421d56ef4d3e7` and first shipped in v0.7.3.\nThe generic forwarding path remains present in current `main`.\n\nThe Isaac path is a concrete high-amplification example:\n\n- `ChatCompletionRequest.mm_processor_kwargs`\n- `OnlineRenderer` request extras\n- `MMProcessorInputs.hf_processor_mm_kwargs`\n- `BaseMultiModalProcessor.info.get_hf_processor(**hf_processor_mm_kwargs)`\n- `IsaacProcessingInfo.get_image_processor(**kwargs)`\n- `IsaacImageProcessor(**kwargs)`\n- `process_vision_for_patches()`\n\nEquivalent constructor forwarding exists in InternVL-derived processors,\nH2OVL, Step3VL, NemotronVL, and other multimodal processors. The issue is at\nthe shared remote-input boundary and is not limited to a fixed model list.\n\n## Impact\n\n- **Availability:** one request can exhaust CPU or GPU memory and terminate a\n  shared service process.\n- **Scope:** all users of the affected service instance lose availability.\n- **Authentication:** vLLM\u0027s API key is optional, so deployments without an\n  external authentication layer are remotely reachable without privileges.\n\n## Remediation\n\nReject non-empty per-request `mm_processor_kwargs` at every API-server request\nschema by default. Operators serving only trusted clients can explicitly opt\nin to the existing override behavior. Server-level `--mm-processor-kwargs` and\noffline `LLM` overrides remain available.\n\nThis shared boundary covers current and future multimodal processors instead\nof maintaining a model-specific list or a denylist that can miss custom\nprocessor arguments.\n\nA patch for this was merged here: https://github.com/vllm-project/vllm/pull/58830",
  "id": "GHSA-gx7p-2j49-hfq4",
  "modified": "2026-10-23T20:58:36Z",
  "published": "2026-10-23T20:58:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-gx7p-2j49-hfq4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114055"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/pull/58830"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/commit/31f2e70cd3e403aaa471fb7fe3d33a7207aaf3cc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vllm-project/vllm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/releases/tag/v0.31.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-dos-via-unvalidated-mm-processor-kwargs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)"
}

CVE-2026-114055 (GCVE-0-2026-114055)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-21 15:50

Title

vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs

Summary

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-21 14:40 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6802 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/vllm-project/vllm/security/adv…	vendor-advisory
https://www.vulncheck.com/advisories/vllm-0.7.3-b…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vllm-project	vllm	Affected: 0.7.3 , < 0.31.0 (semver) Unaffected: 0.31.0 (semver) cpe:2.3:a:vllm:vllm::::::::

Date Public

2026-10-06 00:00

Credits

Chedrian07 jperezdealgaba DarkLight1337

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114055",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T14:40:33.947720Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T15:50:46.285Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/vllm",
          "product": "vllm",
          "vendor": "vllm-project",
          "versions": [
            {
              "lessThan": "0.31.0",
              "status": "affected",
              "version": "0.7.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.31.0",
                  "versionStartIncluding": "0.7.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Chedrian07"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "jperezdealgaba"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "DarkLight1337"
        }
      ],
      "datePublic": "2026-10-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:36:31.227Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-gx7p-2j49-hfq4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-gx7p-2j49-hfq4"
        },
        {
          "name": "VulnCheck Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-dos-via-unvalidated-mm-processor-kwargs"
        }
      ],
      "title": "vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114055",
    "datePublished": "2026-10-21T00:36:31.227Z",
    "dateReserved": "2026-10-20T21:42:27.669Z",
    "dateUpdated": "2026-10-21T15:50:46.285Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-GX7P-2J49-HFQ4

Summary

Affected Components

Impact

Remediation

CVE-2026-114055 (GCVE-0-2026-114055)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour