Inefficient Algorithmic Complexity in vLLM - CVE-2026-126397
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU162984
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126397
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to degrade availability for other clients of vLLM servers serving Cohere2 Vision models.
The vulnerability exists due to missing bounds on request-controlled mm_processor_kwargs.max_patches, which triggers quadratic CPU work during image preprocessing in the Python OpenAI-compatible frontend. An unauthenticated remote attacker can submit a small valid image with a large parameter value to occupy preprocessing workers, although deployments requiring API authentication restrict exploitation to authorized clients.
Affected software
vLLM
How to mitigate CVE-2026-126397
Install security update from vendor's website.
vLLM - update to 0.31.0