CVE-2026-126397

The vLLM library versions 0.10.1 through 0.31.0 are vulnerable to a Denial of Service (DoS) attack affecting Cohere2 Vision models. The root cause is the lack of a server-side upper bound on the mm_processor_kwargs.max_patches value, which is forwarded directly from request-controlled inputs to t...

EUVD-2026-125168

vLLM from 0.10.1 before 0.31.0 forwards a request-controlled mmprocessorkwargs.maxpatches value to the Hugging Face processor for Cohere2 Vision models without a server-side upper bound, causing quadratic CPU work during multimodal preprocessing. Remote clients can send small image chat-completio...