Jperezdealgaba

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust remote code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing llava onevision2.py that executes with vLLM process authority even when trust remote code is set to False.

vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In nano nemotron vl.py, extract audio from videos calls load audio pyav(BytesIO(video bytes)) without the max duration s or max decode bytes parameters, so neither VLLM MAX AUDIO DECODE DURATION S nor VLLM MAX AUDIO DECODE BYTES is enforced (unlike the direct audio upload path in AudioMediaIO). When a NanoNemotronVL model is served with use audio in video=True, an attacker who supplies a small, highly compressed video as multimodal input can force the server to allocate gigabytes of memory during audio decoding, resulting in a denial of service. Fixed in vLLM 0.28.0.

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.27.0 **Description** The software fails to properly classify DeepStream as a GPU backend, which leads to the omission of pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream during a request to initialize the process-wide GPU decode pool and submit video content that bypasses resource controls, resulting in a partial denial of service for concurrent requests. **Recommendations** Update vLLM to version 0.27.0 or later.

Name of the Vulnerable Software and Affected Versions: vLLM versions 0.1.0 through 0.10.1.0 Description: vLLM is an inference and serving engine for large language models (LLMs). A Denial of Service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint, resulting in server memory exhaustion and potential crashes or unresponsiveness. The attack does not require authentication, making it exploitable by any remote user. The vulnerability leverages the abuse of HTTP headers, such as the `X-Forwarded-For` header, by setting it to a very large value. Recommendations: Upgrade to vLLM version 0.10.1.1 or later. Use a proxy in front of vLLM which provides protection against this issue.