CVE-2026-126397: vLLM denial of service via unbounded max_patches in multimodal preprocessing

Summary

vLLM versions from 0.10.1 before 0.31.0 pass a request-controlled mm_processor_kwargs.max_patches value to the Hugging Face processor for Cohere2 Vision models without a server-side upper bound. Large, varying max_patches values cause quadratic CPU work during multimodal preprocessing and bypass the LRU cache. Remote clients can send small image chat-completion requests to exhaust preprocessing workers and deny service to other clients.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Inference infrastructure

Related items

• MediumCVE-2026-126399: vLLM resource exhaustion via video frame limit bypass in chat completionsSimilar attack · NVD/CVE Database
• MediumCVE-2026-126398: vLLM reachable assertion crash in GPUModelRunner via embeddings-only requestsSimilar attack · NVD/CVE Database
• MediumCVE-2026-126396: vLLM resource exhaustion in MiniMax M3 VL video processor via min_pixelsSimilar attack · NVD/CVE Database
• MediumCVE-2026-126394: vLLM resource exhaustion in OpenCVDynamicOpenPanguVideoBackend via num_framesSimilar attack · NVD/CVE Database
• MediumEndor Labs’ AI SAST Finds Zero Day Memory-Amplification DoS in Anthropic’s buffa library | Endor LabsSimilar attack · Endor Labs Blog