Live › vulnerability › CVE-2026-116177
Go to dashboardvLLM before 0.25.0 lets unauthenticated users submit a decompression-bomb image to the chat completions endpoint, because the Nemotron-VL processors globally disable Pillow's pixel limit. The oversized image exhausts memory, OOM-kills the worker and takes the service down for co-tenants.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams running vLLM between 0.10.2 and 0.25.0 that serve Nemotron-VL vision-language models to users who can send requests to /v1/chat/completions. Deployments that do not accept image input or do not serve Nemotron-VL models are less exposed, but the sources do not confirm whether other processors are affected.
No product ranges from the sources yet.
pip show vllm (or python -c "import vllm; print(vllm.__version__)") and check whether the version is between 0.10.2 and 0.25.00.25.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker and deny service to co-tenants.
This page as .md · .json · in your agent: get_signal("CVE-2026-116177")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.