CVE-2026-37237

A flaw was found in vLLM. Remote attackers can exploit this vulnerability by providing a URL to an excessively large media file. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions, responsible for fetching user-supplied media, do not limit the response size. This oversight allows a...

CVE-2026-37237

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read without enforcing a maximum response...

CVE-2026-37237

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read without enforcing a maximum response...