{"data":{"id":"1d8ed02b-90e8-4df0-be51-509a74dca61c","title":"CVE-2026-37237: vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The…","summary":"vLLM versions up to and including 0.17.0 are affected by CVE-2026-37237. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py fetch user-supplied media URLs with aiohttp and call r.read() without enforcing a maximum response size. A remote attacker can exhaust server memory by supplying a URL to an arbitrarily large file, causing a Denial of Service.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-37237","publishedAt":"2026-08-28T16:17:46.300Z","cveId":"CVE-2026-37237","cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM denial of service via unbounded media fetch from remote URLs","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00727,"epssCheckedAt":"2026-11-04T18:09:14.876Z","kevDateAdded":null,"advisoryAliases":["GHSA-63mw-rppr-f2pf"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-01T18:08:58.479Z","patchAvailable":null,"disclosureDate":"2026-08-28T16:17:46.300Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}