VLLM: Ten Vulnerabilities Disclosed Together, Exploiting Input Validation and Resource Management
Ten vulnerabilities in VLLM, disclosed October 25, 2026, allow remote attackers to crash the engine, exhaust resources, or bypass security controls through flaws in input validation and multimodal processing.
Key findings
- Ten vulnerabilities disclosed in VLLM on October 25, 2026, primarily impacting denial of service and resource exhaustion.
- Flaws in multimodal input handling and token ID validation allow for engine crashes and memory exhaustion.
- A server-side request forgery vulnerability enables attackers to force outbound connections.
- Affected versions range from 0.20.1 up to 0.31.0, with patches available in later releases.
- Vulnerabilities span improper input validation, resource consumption, and uninitialized memory allocation.
On October 25, 2026, a batch of ten vulnerabilities was disclosed in the VLLM large language model inference engine, affecting versions prior to a range of releases up to 0.31.0. These vulnerabilities, primarily centered around denial of service and resource exhaustion, could allow remote attackers to crash the engine, consume excessive memory, or bypass security controls. The disclosures highlight potential weaknesses in input validation and resource management within VLLM's multimodal processing and API handling.
Several vulnerabilities stem from improper input validation when handling various media types and token IDs. CVE-2026-116181 and CVE-2026-116174 detail how supplying out-of-vocabulary stop_token_ids or prompt token IDs can lead to engine crashes or fatal embedding lookup failures, respectively. CVE-2026-116178 describes a denial of service achievable by sending inconsistent multimodal metadata to the disaggregated inference endpoint.
Resource exhaustion is another significant theme. CVE-2026-116179 allows API clients to bypass frame-count caps for video/jpeg processing by overriding num_frames, potentially leading to memory exhaustion. Similarly, CVE-2026-116175, affecting Nemotron-VL processors, permits unauthenticated attackers to exhaust memory by submitting decompression-bomb images to the chat completions endpoint due to a lack of image pixel limits. CVE-2026-116173 points to a denial of service in the Rust gRPC frontend where logprob limits can be bypassed by sending excessive output candidates.
Further impacting the engine's stability and security are flaws related to uninitialized memory allocation and server-side request forgery. CVE-2026-116180 involves an uninitialized tensor allocation in LogprobsTensors.empty_cpu(), potentially leading to denial of service. CVE-2026-116176 presents a server-side request forgery vulnerability, allowing API callers to force outbound connections by embedding a decode address in the X-Request-Id header, potentially leaking sensitive information like the NCCL unique_id and KV-cache.
The batch also includes vulnerabilities related to audio processing and log probability limits. CVE-2026-116175 notes that the audio processing path can be exploited via decompression bombs in audio requests, leading to memory exhaustion due to a missing duration limit. CVE-2026-116172 describes an improper input validation in the Rust gRPC converter that allows bypassing max_logprobs limits via CandidateTokens.top_n, potentially triggering errors in torch.topk.
The affected versions range from specific earlier releases up to, but not including, versions 0.29.0, 0.31.0, 0.30.0, 0.25.0, 0.24.0, and 0.31.0, depending on the specific CVE. Users are advised to update to patched versions to mitigate these risks. The broad range of affected versions and the variety of denial-of-service and resource exhaustion vectors underscore the importance of timely patching for VLLM deployments to maintain engine stability and security.
The disclosures highlight the critical need for robust input validation and resource management in complex AI inference engines, particularly when handling diverse multimodal inputs and external requests. Users of VLLM should prioritize updating their installations to the latest versions to address these vulnerabilities.
Key findings from this batch include:
- Multiple denial-of-service and resource exhaustion vulnerabilities disclosed in VLLM.
- Flaws in handling multimodal inputs (images, video, audio) leading to memory exhaustion.
- Improper input validation in token ID and metadata processing causing engine crashes.
- A server-side request forgery vulnerability allowing forced outbound connections.
- Affected versions range widely, with patches available in releases up to 0.31.0.
CVEs included in this report: CVE-2026-116181, CVE-2026-116180, CVE-2026-116179, CVE-2026-116178, CVE-2026-116177, CVE-2026-116176, CVE-2026-116175, CVE-2026-116174, CVE-2026-116173, CVE-2026-116172.