CVE-2026-114055

Analyzed Analyzed - Analysis Complete

Uncontrolled Resource Consumption in vLLM via mm_processor_kwargs

Publication date: 2026-10-21

Last updated on: 2026-11-03

Assigner: VulnCheck

Description

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-11-03

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114055

EUVD

EUVD-2026-107006

Affected Vendors & Products

Vendor	Product	Version / Range
vllm	vllm	From 0.7.3 (inc) to 0.31.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-service (DoS) flaw in vLLM versions 0.7.3 through 0.30.0. It allows remote attackers to exploit the mm_processor_kwargs parameter to set excessively large values for image size, patch count, crop count, or frame count in multimodal processors like Isaac, InternVL, and H2OVL. This causes memory exhaustion and server termination.

Detection Guidance

Monitor for unusually high memory usage or server crashes in vLLM instances, particularly when processing multimodal requests. Check logs for API requests containing large values in mm_processor_kwargs parameters like image size, patch count, crop count, or frame count.

Impact Analysis

This vulnerability can impact you by allowing unauthenticated attackers to crash your vLLM server or worker nodes through memory exhaustion. This disrupts service availability and may lead to downtime for applications relying on vLLM for multimodal processing tasks.

Compliance Impact

This vulnerability primarily affects availability, which is a key aspect of compliance under standards like GDPR and HIPAA. A DoS attack could lead to service disruptions, potentially violating availability requirements and impacting data access or processing timelines.

Mitigation Strategies

Upgrade vLLM to version 0.31.0 or later. If upgrading is not immediately possible, configure the API server to reject non-empty mm_processor_kwargs by default. Ensure API keys are enforced to prevent unauthenticated access.

Hi! I’m here to help you understand CVE-2026-114055. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...