Memory Exhaustion in vLLM via Image Processing

Executive Summary

This vulnerability is an uncontrolled resource consumption issue in vLLM versions 0.10.2 to 0.25.0. It occurs because Nemotron-VL processors globally disable Pillow's decompression-bomb guard by setting Image.MAX_IMAGE_PIXELS to None. Attackers can exploit this by submitting a specially crafted image to the /v1/chat/completions endpoint, causing the server to exhaust memory and crash, leading to a denial-of-service condition.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusually high memory usage on vLLM instances, particularly when processing image inputs via the /v1/chat/completions endpoint. Check logs for OOM (Out of Memory) kills of vLLM worker processes. Use system monitoring tools like top, htop, or ps to observe memory consumption spikes during image processing tasks.

Useful 0 Not Useful 0

Impact Analysis

If you use a vulnerable vLLM version, an unauthenticated attacker could send a malicious image to your server, causing it to run out of memory and crash. This would disrupt service for all users relying on that vLLM instance, potentially leading to downtime or degraded performance.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by causing service disruptions or data unavailability, which may violate availability requirements in GDPR (Article 32) or HIPAA (Security Rule). A denial-of-service condition could lead to unauthorized access or loss of data integrity, potentially resulting in regulatory penalties or breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade vLLM to version 0.25.0 or later. Set the VLLM_MAX_IMAGE_PIXELS environment variable to a safe limit (e.g., 200000000) to enforce a pixel count cap. Remove any code that sets Image.MAX_IMAGE_PIXELS to None globally. Restrict access to the /v1/chat/completions endpoint to trusted sources only.

Useful 0 Not Useful 0