{"id":"CVE-2026-114055","kind":"vulnerability","aliases":["CVE-2026-114055","GHSA-gx7p-2j49-hfq4"],"related":[],"title":"vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)","description":"## Summary\n\nAPI clients can supply arbitrary `mm_processor_kwargs` per request. vLLM\nforwards these values through the multimodal rendering and processing pipeline\nto Hugging Face and custom image/video processor constructors and calls.\nResource-sensitive values such as image size, patch size, patch count, crop\ncount, or frame count can therefore be controlled by a remote client.\n\nFor processors that upscale inputs, a single request can force an allocation\nlarge enough to terminate the API server or worker with an out-of-memory\ncondition.\n\n## Affected Components\n\nThe per-request field was introduced in commit\n`041e29471671a3d43afedb6a749421d56ef4d3e7` and first shipped in v0.7.3.\nThe generic forwarding path remains present in current `main`.\n\nThe Isaac path is a concrete high-amplification example:\n\n- `ChatCompletionRequest.mm_processor_kwargs`\n- `OnlineRenderer` request extras\n- `MMProcessorInputs.hf_processor_mm_kwargs`\n- `BaseMultiModalProcessor.info.get_hf_processor(**hf_processor_mm_kwargs)`\n- `IsaacProcessingInfo.get_image_processor(**kwargs)`\n- `IsaacImageProcessor(**kwargs)`\n- `process_vision_for_patches()`\n\nEquivalent constructor forwarding exists in InternVL-derived processors,\nH2OVL, Step3VL, NemotronVL, and other multimodal processors. The issue is at\nthe shared remote-input boundary and is not limited to a fixed model list.\n\n## Impact\n\n- **Availability:** one request can exhaust CPU or GPU memory and terminate a\n  shared service process.\n- **Scope:** all users of the affected service instance lose availability.\n- **Authentication:** vLLM's API key is optional, so deployments without an\n  external authentication layer are remotely reachable without privileges.\n\n## Remediation\n\nReject non-empty per-request `mm_processor_kwargs` at every API-server request\nschema by default. Operators serving only trusted clients can explicitly opt\nin to the existing override behavior. Server-level `--mm-processor-kwargs` and\noffline `LLM` overrides remain available.\n\nThis shared boundary covers current and future multimodal processors instead\nof maintaining a model-specific list or a denylist that can miss custom\nprocessor arguments.\n\nA patch for this was merged here: https://github.com/vllm-project/vllm/pull/58830","summary":"vLLM forwards arbitrary per-request mm_processor_kwargs from API clients into multimodal image and video processor constructors, so resource-sensitive values like image size or frame count are client-controlled. A remote client can force an out-of-memory allocation that terminates the shared API server or worker process.","severity":"high","cvss":8.7,"epss":0.00343,"exploited":false,"exploited_at":null,"products":[{"name":"vllm","fixed":["0.31.0"],"affected":">= 0.7.3, < 0.31.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-400","multimodal","openai-compatible-api","python","self-hosted","vllm"],"not_affected_if":["no-multimodal-models","offline-llm-only","vllm-0.31.0-or-later","vllm-before-0.7.3"],"how_to_check":"pip show vllm (affected if version is >= 0.7.3 and < 0.31.0)\nCheck whether API clients can send mm_processor_kwargs in chat completion requests","fix":"Upgrade vllm to 0.31.0 or later. Patch referenced: https://github.com/vllm-project/vllm/pull/58830","status":"open","published_at":"2026-10-21T01:17:28+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","triaged_at":"2026-10-23T21:00:16+00:00","updated_at":"2026-10-23T21:57:27+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T21:00:16Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade vllm to 0.31.0 or later. Patch referenced: https://github.com/vllm-project/vllm/pull/58830","reach":"internet","impact":"medium","summary":"vLLM forwards arbitrary per-request mm_processor_kwargs from API clients into multimodal image and video processor constructors, so resource-sensitive values like image size or frame count are client-controlled. A remote client can force an out-of-memory allocation that terminates the shared API server or worker process.","category":"ai-tooling","who_cares":["vllm","multimodal","self-hosted","openai-compatible-api","python"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote client crashes shared vLLM server via memory exhaustion.","analyst_note":"","how_to_check":"pip show vllm (affected if version is >= 0.7.3 and < 0.31.0)\nCheck whether API clients can send mm_processor_kwargs in chat completion requests\nunknown","needs_analyst":false,"not_affected_if":["vllm-before-0.7.3","vllm-0.31.0-or-later","offline-llm-only","no-multimodal-models"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.001105,"input_tokens":3594,"output_tokens":1491,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114055':18A,26A '-2026':17A,25A '-400':32B '/vllm-project/vllm/pull/58830':408C '041e29471671':193C '2j49':22A 'a3d43afedb6a749421d56ef4d3e7':194C 'affect':182C,302C 'ai':29B 'ai-tool':28B 'alloc':87B,165C 'amplif':217C 'api':37B,53B,92B,98C,171C,310C,340C 'api-serv':339C 'arbitrari':45B,102C 'argument':398C 'authent':307C,319C 'avail':282C,306C,372C 'basemultimodalprocessor.info.get':229C 'behavior':359C 'boundari':271C,375C 'call':128C 'chatcompletionrequest.mm':219C 'client':54B,75B,79B,99C,153C,350C 'client-control':74B 'commit':192C 'compat':36B 'compon':183C 'concret':214C 'condit':181C 'constructor':61B,126C,247C 'control':76B,149C 'count':72B,140C,142C,145C 'cover':376C 'cpu':287C 'crop':141C 'current':207C,377C 'custom':123C,396C 'cve':16A,24A 'cwe':31B 'default':345C 'denylist':392C 'deploy':315C 'deriv':253C 'dos':2A 'empti':330C 'enough':167C 'equival':246C 'etc':15A 'everi':338C 'exampl':218C 'exhaust':286C 'exist':249C,357C 'explicit':352C 'extern':318C 'extra':224C 'face':121C 'field':188C 'first':196C 'fix':278C 'forc':81B,163C 'forward':44B,109C,202C,248C 'frame':71B,144C 'futur':379C 'generic':201C 'ghsa':20A 'ghsa-gx7p-2j49-hfq4':19A 'github.com':407C 'github.com/vllm-project/vllm/pull/58830':406C 'gpu':289C 'gx7p':21A 'h2ovl':14A,255C 'hf':230C,232C 'hfq4':23A 'high':216C 'high-amplif':215C 'host':41B 'hug':120C 'imag':10A,57B,68B,135C,237C 'image/video':124C 'impact':281C 'input':158C,270C 'instanc':304C 'instead':382C 'internvl':13A,252C 'internvl-deriv':251C 'introduc':190C 'isaac':12A,210C 'isaacimageprocessor':240C 'isaacprocessinginfo.get':236C 'issu':263C 'key':311C 'kwarg':7A,51B,105C,221C,228C,235C,239C,241C,336C,366C 'larg':166C 'layer':320C 'level':362C 'like':67B 'limit':275C 'list':280C,389C 'llm':369C 'lose':305C 'main':208C 'maintain':384C 'memori':86B,180C,290C 'merg':404C 'miss':395C 'mm':5A,49B,103C,227C,234C,334C,364C 'mm-processor-kwarg':363C 'mmprocessorinputs.hf':225C 'model':279C,387C 'model-specif':386C 'multimod':9A,33B,56B,114C,260C,380C 'nemotronvl':257C 'non':329C 'non-empti':328C 'offlin':368C 'one':283C 'onlinerender':222C 'openai':35B 'openai-compatible-api':34B 'oper':346C 'opt':353C 'option':313C 'out-of-memori':83B,177C 'overrid':358C,370C 'patch':137C,139C,245C,400C 'path':203C,211C 'per':47B,106C,186C,332C 'per-request':46B,185C,331C 'pipelin':118C 'present':205C 'privileg':325C 'process':96B,117C,242C,296C 'processor':6A,11A,50B,60B,104C,125C,155C,220C,226C,231C,233C,238C,254C,261C,335C,365C,381C,397C 'python':38B 'reachabl':323C 'reject':327C 'remain':204C,371C 'remedi':326C 'remot':78B,152C,269C,322C 'remote-input':268C 'render':115C 'request':48B,107C,161C,187C,223C,284C,333C,342C 'resourc':64B,130C 'resource-sensit':63B,129C 'schema':343C 'scope':297C 'self':40B 'self-host':39B 'sensit':65B,131C 'serv':347C 'server':93B,172C,341C,361C 'server-level':360C 'servic':295C,303C 'share':91B,267C,294C,374C 'ship':197C 'singl':160C 'size':69B,136C,138C 'specif':388C 'step3vl':256C 'summari':97C 'suppli':101C 'termin':89B,169C,292C 'therefor':147C 'tool':30B 'trust':349C 'unvalid':4A 'upscal':157C 'user':299C 'v0.7.3':199C 'valu':66B,111C,132C 'via':3A 'video':59B 'vision':243C 'vllm':1A,27A,42B,43B,108C,308C 'without':316C,324C 'worker':95B,174C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-gx7p-2j49-hfq4","url":"https://github.com/advisories/GHSA-gx7p-2j49-hfq4","severity":"high","published_at":"2026-10-23T20:58:36+00:00","modified_at":"2026-10-23T20:58:38+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","fetched_at":"2026-10-23T21:39:59+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-114055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114055","severity":null,"published_at":"2026-10-21T01:17:28+00:00","modified_at":"2026-10-22T15:44:59+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}