{"id":"GHSA-5r3c-5x4v-8gjh","kind":"vulnerability","aliases":["GHSA-5r3c-5x4v-8gjh"],"related":[],"title":"Missing request-wide media budget allows single-request frontend resource exhaustion","description":"### Summary\n\n  A remote inference client can submit one request containing many individually valid remote images. vLLM validates only\n  the image count and per-item limits before scheduling every image for download and decoding. It does not enforce a\n  request-wide encoded-byte, decoded-byte, or memory budget.\n\n  For models permitting multiple images, one compact request can therefore consume outbound connections, decoder CPU,\n  and API-frontend memory before prompt-length admission. API authentication is optional by default; when enabled,\n  ordinary inference access is sufficient.\n\n  Affected entry points include /v1/messages, non-Harmony /v1/responses, and equivalent chat-rendering paths.\n\n  ### Details\n\n  The verified flow is:\n\n  1. parse_image() registers a deferred fetch after count validation.\n  2. AsyncMultiModalItemTracker.resolve_items() starts all registered media operations in one asyncio.gather() and\n     materializes every result.\n\n  3. MediaConnector.load_from_url_async() downloads and decodes each response independently.\n  4. The HTTP size limit is per response, not per request.\n  5. ImageMediaIO.load_bytes() eagerly decodes each image into a MediaWithBytes, retaining both the decoded raster and\n     original bytes.\n\n  6. _resolve_items() retains the complete result list.\n  7. Fetching precedes downstream template/token-length admission in the HF renderer and Responses renderer.\n\n  MultiModalConfig defaults an unspecified modality count to 999. Representative LLaVA processing information supplies\n  no lower model-specific limit.\n\n  The aiohttp connection-pool limit of 100 and vLLM’s eight-worker decode pool constrain instantaneous concurrency, but\n  do not constrain aggregate request memory. Completed images accumulate until gathering and later preprocessing finish.\n\n  A complete fix should enforce a request-wide media resource budget, including aggregate encoded/decoded-byte\n  accounting, bounded request/process concurrency, and cancellation/release after validation failure or budget\n  exhaustion.\n\n  ### Impact\n\n  A remote client can cause disproportionate frontend memory, CPU, network, and connection-pool consumption with one\n  syntactically small request containing many compressed-image URLs. This work occurs before prompt-length rejection, so\n  even an over-context request can incur the full media cost.\n\n  Possible consequences include API-process termination, decoder saturation, outbound-connection occupation, and\n  degraded availability for other clients.\n\n  The bounded PoC demonstrates the resource-allocation and retention primitive, not an actual out-of-memory crash.\n\nA fix for this was introduced in https://github.com/vllm-project/vllm/pull/61226.","summary":"vLLM downloads and decodes every image in a request without a request-wide size or memory budget, so one compact request with many remote image URLs can consume API-frontend memory, decoder CPU and outbound connections before prompt length is checked. An attacker can degrade or crash the API process for other clients.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vllm","fixed":["0.33.0"],"affected":">= 0.6.0, < 0.33.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-400","cwe-770","llm-inference","multimodal","self-hosted","vllm"],"not_affected_if":["auth-required","internal-only-network","text-only-models"],"how_to_check":"- Check the installed version with `pip show vllm` and confirm whether it is at least `0.33.0`.\n- Check whether the server is reachable from untrusted clients and whether API key authentication is enabled, since authentication is optional by default.\n- Check whether the served model accepts multiple images per request.","fix":"- Upgrade vLLM to `0.33.0` or later.","status":"open","published_at":"2026-11-02T19:48:58+00:00","first_seen_at":"2026-11-09T22:53:23+00:00","triaged_at":"2026-11-09T22:54:24+00:00","updated_at":"2026-11-09T22:54:24+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:54:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vLLM to `0.33.0` or later.","reach":"internet","title":"vLLM: one request with many image URLs exhausts frontend memory and CPU","impact":"medium","summary":"vLLM downloads and decodes every image in a request without a request-wide size or memory budget, so one compact request with many remote image URLs can consume API-frontend memory, decoder CPU and outbound connections before prompt length is checked. An attacker can degrade or crash the API process for other clients.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["vllm","self-hosted","llm-inference","multimodal"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"API process crashes or stalls, degrading service for other clients","analyst_note":"","how_to_check":"- Check the installed version with `pip show vllm` and confirm whether it is at least `0.33.0`.\n- Check whether the server is reachable from untrusted clients and whether API key authentication is enabled, since authentication is optional by default.\n- Check whether the served model accepts multiple images per request.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["text-only-models","auth-required","internal-only-network"],"who_is_affected":"Teams that run vLLM as an API server for multimodal models that accept multiple images per request, especially where the endpoint is reachable from untrusted clients. Authentication is optional by default, and the affected endpoints include /v1/messages, non-Harmony /v1/responses and equivalent chat-rendering paths. Deployments that only serve text models or sit behind strict access control are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000846,"input_tokens":5441,"output_tokens":603,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-400':29B '-770':31B '/v1/messages':188C '/v1/responses':192C '/vllm-project/vllm/pull/61226.':466C '1':204C '100':316C '2':214C '3':229C '4':240C '5':251C '5r3c':16A,21A '5x4v':17A,22A '6':269C '7':277C '8gjh':18A,23A '999':297C 'access':181C 'account':359C 'accumul':337C 'actual':451C 'admiss':170C,282C 'affect':184C 'aggreg':332C,357C 'ai':26B 'ai-tool':25B 'aiohttp':310C 'alloc':445C 'allow':7A 'api':70B,90B,163C,171C,423C 'api-frontend':69B,162C 'api-process':422C 'async':233C 'asyncio.gather':224C 'asyncmultimodalitemtracker.resolve':215C 'attack':84B 'authent':172C 'avail':434C 'bound':360C,439C 'budget':6A,57B,145C,355C,369C 'byte':139C,142C,253C,268C 'cancellation/release':364C 'caus':376C 'chat':196C 'chat-rend':195C 'check':82B 'client':94B,99C,374C,437C 'compact':60B,152C 'complet':274C,335C,345C 'compress':395C 'compressed-imag':394C 'concurr':327C,362C 'connect':77B,158C,312C,384C,430C 'connection-pool':311C,383C 'consequ':420C 'constrain':325C,331C 'consum':68B,156C 'consumpt':386C 'contain':104C,392C 'context':411C 'cost':418C 'count':115C,212C,295C 'cpu':74B,160C,380C 'crash':88B,456C 'cwe':28B,30B 'decod':43B,73B,128C,141C,159C,236C,255C,264C,323C,426C 'decoded-byt':140C 'default':176C,291C 'defer':209C 'degrad':86B,433C 'demonstr':441C 'detail':199C 'disproportion':377C 'download':41B,126C,234C 'downstream':280C 'eager':254C 'eight':321C 'eight-work':320C 'enabl':178C 'encod':138C 'encoded-byt':137C 'encoded/decoded-byte':358C 'enforc':132C,348C 'entri':185C 'equival':194C 'even':407C 'everi':44B,123C,227C 'exhaust':13A,370C 'failur':367C 'fetch':210C,278C 'finish':343C 'fix':346C,458C 'flow':202C 'frontend':11A,71B,164C,378C 'full':416C 'gather':339C 'ghsa':15A,20A 'ghsa-5r3c-5x4v-8gjh':14A,19A 'github.com':465C 'github.com/vllm-project/vllm/pull/61226.':464C 'harmoni':191C 'hf':285C 'host':38B 'http':242C 'imag':45B,65B,109C,114C,124C,150C,206C,257C,336C,396C 'imagemediaio.load':252C 'impact':371C 'includ':187C,356C,421C 'incur':414C 'independ':239C 'individu':106C 'infer':34B,98C,180C 'inform':301C 'instantan':326C 'introduc':462C 'item':119C,216C,271C 'later':341C 'length':80B,169C,404C 'limit':120C,244C,308C,314C 'list':276C 'llava':299C 'llm':33B 'llm-infer':32B 'lower':304C 'mani':63B,105C,393C 'materi':226C 'media':5A,220C,353C,417C 'mediaconnector.load':230C 'mediawithbyt':260C 'memori':56B,72B,144C,165C,334C,379C,455C 'miss':1A 'modal':294C 'model':147C,306C 'model-specif':305C 'multimod':35B 'multimodalconfig':290C 'multipl':149C 'network':381C 'non':190C 'non-harmoni':189C 'occup':431C 'occur':400C 'one':59B,102C,151C,223C,388C 'oper':221C 'option':174C 'ordinari':179C 'origin':267C 'out-of-memori':452C 'outbound':76B,157C,429C 'outbound-connect':428C 'over-context':409C 'pars':205C 'path':198C 'per':118C,246C,249C 'per-item':117C 'permit':148C 'poc':440C 'point':186C 'pool':313C,324C,385C 'possibl':419C 'preced':279C 'preprocess':342C 'primit':448C 'process':91B,300C,424C 'prompt':79B,168C,403C 'prompt-length':167C,402C 'raster':265C 'regist':207C,219C 'reject':405C 'remot':64B,97C,108C,373C 'render':197C,286C,289C 'repres':298C 'request':3A,10A,48B,52B,61B,103C,135C,153C,250C,333C,351C,391C,412C 'request-wid':2A,51B,134C,350C 'request/process':361C 'resolv':270C 'resourc':12A,354C,444C 'resource-alloc':443C 'respons':238C,247C,288C 'result':228C,275C 'retain':261C,272C 'retent':447C 'satur':427C 'schedul':122C 'self':37B 'self-host':36B 'singl':9A 'single-request':8A 'size':54B,243C 'small':390C 'specif':307C 'start':217C 'submit':101C 'suffici':183C 'summari':95C 'suppli':302C 'syntact':389C 'template/token-length':281C 'termin':425C 'therefor':155C 'tool':27B 'unspecifi':293C 'url':66B,232C,397C 'valid':107C,111C,213C,366C 'verifi':201C 'vllm':24A,39B,40B,110C,318C 'wide':4A,53B,136C,352C 'without':49B 'work':399C 'worker':322C","nicknames":[],"mitigations":[],"who_affected":"Teams that run vLLM as an API server for multimodal models that accept multiple images per request, especially where the endpoint is reachable from untrusted clients. Authentication is optional by default, and the affected endpoints include /v1/messages, non-Harmony /v1/responses and equivalent chat-rendering paths. Deployments that only serve text models or sit behind strict access control are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["vllm"],"ptokens":["vllm"],"labels":["aitooling","cwe400","cwe770","high","llminference","multimodal","pypi","selfhosted","vllm"],"campaign_type":null,"search_a":"'5r3c':16A,21A '5x4v':17A,22A '8gjh':18A,23A 'allow':7A 'budget':6A 'exhaust':13A 'frontend':11A 'ghsa':15A,20A 'ghsa-5r3c-5x4v-8gjh':14A,19A 'media':5A 'miss':1A 'request':3A,10A 'request-wid':2A 'resourc':12A 'singl':9A 'single-request':8A 'vllm':24A 'wide':4A","search_b":"'-400':29B '-770':31B 'ai':26B 'ai-tool':25B 'api':70B,90B 'api-frontend':69B 'attack':84B 'budget':57B 'check':82B 'client':94B 'compact':60B 'connect':77B 'consum':68B 'cpu':74B 'crash':88B 'cwe':28B,30B 'decod':43B,73B 'degrad':86B 'download':41B 'everi':44B 'frontend':71B 'host':38B 'imag':45B,65B 'infer':34B 'length':80B 'llm':33B 'llm-infer':32B 'mani':63B 'memori':56B,72B 'multimod':35B 'one':59B 'outbound':76B 'process':91B 'prompt':79B 'remot':64B 'request':48B,52B,61B 'request-wid':51B 'self':37B 'self-host':36B 'size':54B 'tool':27B 'url':66B 'vllm':39B,40B 'wide':53B 'without':49B","search_c":"'/v1/messages':188C '/v1/responses':192C '/vllm-project/vllm/pull/61226.':466C '1':204C '100':316C '2':214C '3':229C '4':240C '5':251C '6':269C '7':277C '999':297C 'access':181C 'account':359C 'accumul':337C 'actual':451C 'admiss':170C,282C 'affect':184C 'aggreg':332C,357C 'aiohttp':310C 'alloc':445C 'api':163C,171C,423C 'api-frontend':162C 'api-process':422C 'async':233C 'asyncio.gather':224C 'asyncmultimodalitemtracker.resolve':215C 'authent':172C 'avail':434C 'bound':360C,439C 'budget':145C,355C,369C 'byte':139C,142C,253C,268C 'cancellation/release':364C 'caus':376C 'chat':196C 'chat-rend':195C 'client':99C,374C,437C 'compact':152C 'complet':274C,335C,345C 'compress':395C 'compressed-imag':394C 'concurr':327C,362C 'connect':158C,312C,384C,430C 'connection-pool':311C,383C 'consequ':420C 'constrain':325C,331C 'consum':156C 'consumpt':386C 'contain':104C,392C 'context':411C 'cost':418C 'count':115C,212C,295C 'cpu':160C,380C 'crash':456C 'decod':128C,141C,159C,236C,255C,264C,323C,426C 'decoded-byt':140C 'default':176C,291C 'defer':209C 'degrad':433C 'demonstr':441C 'detail':199C 'disproportion':377C 'download':126C,234C 'downstream':280C 'eager':254C 'eight':321C 'eight-work':320C 'enabl':178C 'encod':138C 'encoded-byt':137C 'encoded/decoded-byte':358C 'enforc':132C,348C 'entri':185C 'equival':194C 'even':407C 'everi':123C,227C 'exhaust':370C 'failur':367C 'fetch':210C,278C 'finish':343C 'fix':346C,458C 'flow':202C 'frontend':164C,378C 'full':416C 'gather':339C 'github.com':465C 'github.com/vllm-project/vllm/pull/61226.':464C 'harmoni':191C 'hf':285C 'http':242C 'imag':109C,114C,124C,150C,206C,257C,336C,396C 'imagemediaio.load':252C 'impact':371C 'includ':187C,356C,421C 'incur':414C 'independ':239C 'individu':106C 'infer':98C,180C 'inform':301C 'instantan':326C 'introduc':462C 'item':119C,216C,271C 'later':341C 'length':169C,404C 'limit':120C,244C,308C,314C 'list':276C 'llava':299C 'lower':304C 'mani':105C,393C 'materi':226C 'media':220C,353C,417C 'mediaconnector.load':230C 'mediawithbyt':260C 'memori':144C,165C,334C,379C,455C 'modal':294C 'model':147C,306C 'model-specif':305C 'multimodalconfig':290C 'multipl':149C 'network':381C 'non':190C 'non-harmoni':189C 'occup':431C 'occur':400C 'one':102C,151C,223C,388C 'oper':221C 'option':174C 'ordinari':179C 'origin':267C 'out-of-memori':452C 'outbound':157C,429C 'outbound-connect':428C 'over-context':409C 'pars':205C 'path':198C 'per':118C,246C,249C 'per-item':117C 'permit':148C 'poc':440C 'point':186C 'pool':313C,324C,385C 'possibl':419C 'preced':279C 'preprocess':342C 'primit':448C 'process':300C,424C 'prompt':168C,403C 'prompt-length':167C,402C 'raster':265C 'regist':207C,219C 'reject':405C 'remot':97C,108C,373C 'render':197C,286C,289C 'repres':298C 'request':103C,135C,153C,250C,333C,351C,391C,412C 'request-wid':134C,350C 'request/process':361C 'resolv':270C 'resourc':354C,444C 'resource-alloc':443C 'respons':238C,247C,288C 'result':228C,275C 'retain':261C,272C 'retent':447C 'satur':427C 'schedul':122C 'size':243C 'small':390C 'specif':307C 'start':217C 'submit':101C 'suffici':183C 'summari':95C 'suppli':302C 'syntact':389C 'template/token-length':281C 'termin':425C 'therefor':155C 'unspecifi':293C 'url':232C,397C 'valid':107C,111C,213C,366C 'verifi':201C 'vllm':110C,318C 'wide':136C,352C 'work':399C 'worker':322C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-02T19:48:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-5r3c-5x4v-8gjh","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-5r3c-5x4v-8gjh","severity":"high","published_at":"2026-11-02T19:48:58+00:00","modified_at":"2026-11-02T19:48:58+00:00","first_seen_at":"2026-11-09T22:53:23+00:00","fetched_at":"2026-11-09T22:53:23+00:00","note":null}],"documents":[{"id":110581,"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-5r3c-5x4v-8gjh","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}