PT-2026-120181

CVE-2026-114055

Published

2026-10-21

Updated

2026-10-23

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions vLLM versions 0.7.3 through 0.30.x

Description An uncontrolled resource consumption issue allows remote clients to manipulate multimodal processor parameters by providing per-request mm processor kwargs. Attackers can specify excessive values for image size, patch count, crop count, or frame count within processors such as Isaac, InternVL, and H2OVL to exhaust system memory and cause the shared server to terminate.

Recommendations Update vLLM to version 0.31.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Chedrian07

Darklight1337

Jperezdealgaba

Vendors

Affected products

Weakness enumeration