Darklight1337

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm processor kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.

🚨High - vLLM RCE via AutoProcessor code revision Injection (CVE-2026-114053) vLLM forwards client-supplied mm processor kwargs.code revision into Transformers AutoProcessor.from pretrained when trust remote code is enabled, letting attackers pick a malicious model revision whose dynamic processor code is imported. If the attacker controls a revision in the served model repo, a multimodal request to the unauthenticated /tokenize endpoint yields arbitrary Python code execution in the API process. 👉Affected: vllm >= 0.7.3, < 0.31.0 | Upgrade to 0.31.0

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm processor kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.27.0 **Description** The software fails to properly classify DeepStream as a GPU backend, which leads to the omission of pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream during a request to initialize the process-wide GPU decode pool and submit video content that bypasses resource controls, resulting in a partial denial of service for concurrent requests. **Recommendations** Update vLLM to version 0.27.0 or later.