CVE-2026-100650: vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls

vLLM versions up to 0.29.0 have a security flaw where it downloads and processes media files (like audio) completely before checking size limits, allowing attackers to cause denial of service (making the server unavailable) by sending extremely large files that exhaust memory and bandwidth. The flaw affects multiple entry points, including an unauthenticated route in the Rust frontend, though there is no risk of code execution or data theft.