CVE-2026-37237

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.17.1

Description Remote attackers can cause a Denial of Service through memory exhaustion. The AsyncMediaIO.fetch audio() and AsyncMediaIO.fetch image() functions in multimodal/inputs.py use aiohttp to fetch user-supplied media URLs and execute r.read() without enforcing a maximum response size. This allows an attacker to exhaust server memory by providing a URL to an arbitrarily large file.

Recommendations Update vLLM to a version later than 0.17.0. As a temporary mitigation, restrict the use of the AsyncMediaIO.fetch audio() and AsyncMediaIO.fetch image() functions.