CVE-2026-37237: vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMed

vLLM (a large language model serving framework) versions up to 0.17.0 have a vulnerability where two functions that fetch media files from user-provided URLs do not limit how much data they download, allowing attackers to crash the server by pointing it to extremely large files and exhausting its memory (a DoS or denial of service attack, where a system becomes unusable).