vLLM Denial of Service via Unbounded max_patches Parameter

Executive Summary

This vulnerability affects vLLM versions 0.10.1 through 0.30.0 when serving Cohere2 Vision models. It allows remote attackers to send requests with large or varying max_patches values in the mm_processor_kwargs parameter. The server forwards this client-controlled value to the Hugging Face processor without a server-side upper limit, causing quadratic CPU workload during multimodal preprocessing. This exhausts preprocessing workers and denies service to other clients.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor CPU usage spikes during multimodal preprocessing tasks. Check vLLM server logs for requests with unusually large max_patches values in mm_processor_kwargs. Use network monitoring tools to identify repeated small image requests with varying max_patches parameters.

Useful 0 Not Useful 0

Impact Analysis

If you use vLLM versions 0.10.1 to 0.30.0 with Cohere2 Vision models, an attacker could exploit this to cause a denial of service. Your system may experience high CPU usage, slow response times, or complete unavailability for other users. The attack requires no authentication in default configurations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade vLLM to version 0.31.0 or later. If upgrading is not immediately possible, implement server-side validation to enforce a maximum value for max_patches in mm_processor_kwargs. Restrict access to the vLLM server by requiring API keys or authentication.

Useful 0 Not Useful 0