CVE-2026-100650 vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization

vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls the VLLMMAXAUDIOCLIPFILESIZEMB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits. Across four ingress paths — the shared...