CVE-2026-126397

The vLLM library versions 0.10.1 through 0.31.0 are vulnerable to a Denial of Service (DoS) attack affecting Cohere2 Vision models. The root cause is the lack of a server-side upper bound on the mm_processor_kwargs.max_patches value, which is forwarded directly from request-controlled inputs to t...