CVE-2026-114055

Versions vLLM from 0.7.3 before 0.31.0 are vulnerable to an uncontrolled resource consumption flaw (CWE-400 ). The issue stems from unvalidated mm_processor_kwargs parameters supplied by remote clients. Attackers can manipulate values such as image size, patch count, crop count, or frame count in...

EUVD-2026-107006

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mmprocessorkwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac,...

CVE-2026-114052

The vLLM framework (versions after 0.24.0 and before 0.31.0) contains a memory exhaustion vulnerability within the MOSS-Audio model serving component. The root cause is the use of an unbounded dictionary that caches a processor for every unique request-controlled mm_processor_kwargs value. Unauth...

EUVD-2026-107003

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mmprocessorkwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized melconfig values to...