CVE-2026-116177

The vLLM library, versions 0.10.2 before 0.25.0 , is vulnerable to a Denial of Service (DoS) attack due to uncontrolled resource consumption. The root cause is that Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None, bypassing decompression-bomb guards. Unauthenticated attackers c...