EUVD-2026-107006

vLLM : DoS via unvalidated mmprocessorkwargs in multimodal image processors Isaac, InternVL, H2OVL, etc...

CVE-2026-114055

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mmprocessorkwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac,...

CVE-2026-114055 vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mmprocessorkwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac,...

CVE-2026-114055 vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mmprocessorkwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac,...

CVE-2026-114055 vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mmprocessorkwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac,...

CVE-2026-114055

Versions vLLM from 0.7.3 before 0.31.0 are vulnerable to an uncontrolled resource consumption flaw (CWE-400 ). The issue stems from unvalidated mm_processor_kwargs parameters supplied by remote clients. Attackers can manipulate values such as image size, patch count, crop count, or frame count in...

CVE-2026-114055

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mmprocessorkwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac,...

PT-2026-120181

Name of the Vulnerable Software and Affected Versions vLLM versions 0.7.3 through 0.30.x Description An uncontrolled resource consumption issue allows remote clients to manipulate multimodal processor parameters by providing per-request mm processor kwargs. Attackers can specify excessive values...

WS-2026-0140

vllm 0.20.0 - 0.31.0: the public /inference/v1/generate route accepts caller-forged multimodal SHM cache handles address, monotonicid that the worker dereferences without authentication, reaching pickle.loads on attacker-staged bytes when the SHM multimodal processor cache is enabled...

Reachable Assertion

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Reachable Assertion via a P0/P1 multimodal processor cache drift condition in vllm/multimodal/cache.py and the V1 engine core. When the frontend P0...

vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

Summaryvllm/transformersutils/processors/mimov2omni.py — the multimodal processor for MiMoV2OmniForCausalLM — issues requests.get... directly on user-supplied image and audio URL strings and Image.open... on user-supplied local paths, without the SSRF / allowedlocalmediapath checks that...

vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

Summary vllm/transformersutils/processors/mimov2omni.py — the multimodal processor for MiMoV2OmniForCausalLM — issues requests.get... directly on user-supplied image and audio URL strings and Image.open... on user-supplied local paths, without the SSRF / allowedlocalmediapath checks that...

GHSA-4HHP-H66F-J5J7 vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

Summary vllm/transformersutils/processors/mimov2omni.py — the multimodal processor for MiMoV2OmniForCausalLM — issues requests.get... directly on user-supplied image and audio URL strings and Image.open... on user-supplied local paths, without the SSRF / allowedlocalmediapath checks that...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that stems from a denial-of-service issue in the multi-modal call processor when processing UE policy containers...