CVE-2026-116177

Name of the Vulnerable Software and Affected Versions vLLM versions 0.10.2 through 0.24.9

Description Unauthenticated attackers can cause memory exhaustion because Nemotron-VL processors globally set Image.MAX IMAGE PIXELS to None. By submitting a pathological decompression-bomb image to the '/v1/chat/completions' endpoint, an attacker can trigger an Out-Of-Memory (OOM) kill of the worker, resulting in a denial of service for other tenants.

Recommendations Update vLLM to version 0.25.0 or later.