SB2026100645 - Multiple vulnerabilities in vLLM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026100645

SB2026100645 - Multiple vulnerabilities in vLLM

Published: October 6, 2026 Updated: November 13, 2026

Security Bulletin ID SB2026100645
CSH Severity
High
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 9% Medium 45% Low 45%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Insufficient verification of data authenticity (CVE-ID: CVE-2026-114050)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to insufficient verification of data authenticity in the multimodal processor caches when handling multimodal requests with user-supplied UUIDs. A remote user can submit a crafted multimodal request with a reused UUID to cause a denial of service.

Successful exploitation requires the P0 sender cache to evict an item while the P1 receiver cache retains the corresponding stale item.


2) Uncaught Exception (CVE-ID: CVE-2026-114051)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an uncaught exception in the EngineCore input processing thread when decoding a generation request with inconsistent token limits. A remote user can send a specially crafted request to cause a denial of service.

The health endpoint can continue returning HTTP 200 after generation requests stop being served.


3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-114052)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the MOSS-Audio processor cache when processing request-controlled mm_processor_kwargs through the /tokenize endpoint. A remote attacker can submit distinct processor configurations or oversized mel_config values to cause a denial of service.

Only deployments serving a MOSS-Audio model are vulnerable.


4) Code Injection (CVE-ID: CVE-2026-114053)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of code generation in vLLM processor construction when processing multimodal requests containing request-controlled mm_processor_kwargs.code_revision. A remote attacker can send a multimodal request that selects an attacker-controlled processor code revision to execute arbitrary code.

Exploitation requires a served model whose processor uses dynamic auto_map code, trust_remote_code to be enabled, and access to an attacker-controlled revision in the served model repository.


5) Expected behavior violation (CVE-ID: CVE-2026-114049)

CWE-ID: CWE-440 - Expected Behavior Violation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to constrain another client's generated output to an attacker-chosen token allowlist.

The vulnerability exists due to failure to clear a vacated token-allowlist mask row in vLLM V1 InputBatch.condense() when compacting active batch requests. A remote attacker can submit a request with chosen allowed_token_ids and trigger concurrent batch-slot reuse while that constrained request remains active to make an unrestricted request inherit the stale allowlist.


6) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-126395)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to obtain a live heap address of the vLLM API server process in multimodal deployments.

The vulnerability exists due to vLLM's lowercase-only error sanitization regex failing to remove uppercase PIL image addresses when multimodal processing fails. An unauthenticated remote attacker can send a PNG to /tokenize and receive an address in an error response, even when an API key is configured.


7) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-126396)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to consume excessive host memory and CPU resources, potentially disrupting a vLLM service.

The vulnerability exists due to unchecked request-controlled min_pixels values and a skipped video-wide resource limit in MiniMax M3 video preprocessing when the default resize mode is used. An unauthenticated remote attacker can submit a video with an oversized min_pixels value to a deployment accepting request-level mm_processor_kwargs overrides, causing disproportionate frame enlargement and resource consumption before engine validation.


8) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-126397)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to degrade availability for other clients of vLLM servers serving Cohere2 Vision models.

The vulnerability exists due to missing bounds on request-controlled mm_processor_kwargs.max_patches, which triggers quadratic CPU work during image preprocessing in the Python OpenAI-compatible frontend. An unauthenticated remote attacker can submit a small valid image with a large parameter value to occupy preprocessing workers, although deployments requiring API authentication restrict exploitation to authorized clients.


9) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-126399)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to bypass frame limits and increase memory consumption in vLLM deployments serving video-capable multimodal models.

The vulnerability exists due to request-level media_io_kwargs.video.num_frames overriding the server's frame ceiling during JPEG video decoding. A low-privileged remote attacker can submit a video request with this value set to -1 to decode every supplied frame, using a valid inference API key when authentication is configured.


10) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-114054)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker with low privileges to cause cross-request substitution of cached processed images in vLLM.

The vulnerability exists due to the multimodal processor cache using a caller-controlled UUID in EXIF ImageID metadata as image identity without binding it to image content or the requesting principal. A remote attacker with low privileges can submit different images carrying the same UUID so later requests receive the first image's cached processed media.


11) Resource exhaustion (CVE-ID: CVE-2026-126394)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to exhaust memory and CPU resources on video-capable vLLM deployments, degrading service availability.

The vulnerability exists due to missing limits on request-controlled num_frames in OpenCVDynamicOpenPanguVideoBackend when a negative fps bypasses the sampling bound. An unauthenticated remote attacker can submit a video request to /v1/chat/completions, select the backend through media_io_kwargs.video.video_backend, and supply an excessive frame count to trigger resource-intensive processing without victim interaction.


Remediation

Install update from vendor's website.

References