CVE-2026-114055: vLLM uncontrolled resource consumption via per-request mm_processor_kwargs

Summary

vLLM versions from 0.7.3 before 0.31.0 contain CVE-2026-114055, an uncontrolled resource consumption flaw. Remote clients can supply per-request mm_processor_kwargs to set large image size, patch count, crop count, or frame count values in the Isaac, InternVL, H2OVL, and other multimodal processors. This exhausts memory and terminates the shared server.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Inference infrastructure

Related items

• HighCVE-2026-114052: vLLM memory exhaustion in MOSS-Audio model serving via /tokenize endpointSimilar attack · NVD/CVE Database
• HighCVE-2026-114051: vLLM validation bypass in /inference/v1/generate requests with null max_tokensSimilar attack · NVD/CVE Database
• HighCVE-2026-114050: vLLM denial of service via client-supplied multimodal uuid cache desyncSimilar attack · NVD/CVE Database
• HighGHSA-46jr-4wx8-v453: MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationSimilar attack · GitHub Advisory Database
• LowLLM Trojans that Increase Response Lengths and CostSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)