VLLM · CVE-2026-126397 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
vLLM forwards a request-supplied max_patches value to the Hugging Face processor for Cohere2 Vision models with no server-side upper bound. A remote client can send small image requests with large varying values to force quadratic CPU work and deny service to other users.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run a vLLM server with Cohere2 Vision multimodal models and accept image chat-completion requests from clients they do not fully trust. Text-only deployments and servers that do not serve these models are not exposed by this description.
Not affected if managed-hosting, no-untrusted-clients, text-only-models
Who cares llm-serving, multimodal, self-hosted, vllm
pip show vllm and compare it to the range below.vllm 0.31.0 or later (fixed version per the NVD range: before 0.31.0 is affected).vLLM from 0.10.1 before 0.31.0 forwards a request-controlled mm_processor_kwargs.max_patches value to the Hugging Face processor for Cohere2 Vision models without a server-side upper bound, causing quadratic CPU work during multimodal preprocessing. Remote clients can send small image chat-completion requests with large, varying max_patches values to bypass the LRU cache, exhaust preprocessing workers, and deny service to other clients.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.