{"data":{"id":"b0aedfa9-b517-40ca-82b7-42272265cb80","title":"CVE-2026-114055: vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to…","summary":"vLLM versions from 0.7.3 before 0.31.0 contain CVE-2026-114055, an uncontrolled resource consumption flaw. Remote clients can supply per-request mm_processor_kwargs to set large image size, patch count, crop count, or frame count values in the Isaac, InternVL, H2OVL, and other multimodal processors. This exhausts memory and terminates the shared server.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114055","publishedAt":"2026-10-21T01:17:28.363Z","cveId":"CVE-2026-114055","cweIds":["CWE-400"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["vLLM","Isaac","InternVL","H2OVL"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM uncontrolled resource consumption via per-request mm_processor_kwargs","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-21T06:10:51.466Z","kevDateAdded":null,"advisoryAliases":["GHSA-3cgq-c484-rx5j"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-21T06:10:54.935Z","patchAvailable":null,"disclosureDate":"2026-10-21T01:17:28.363Z","capecIds":["CAPEC-125","CAPEC-130"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}