VLLM · GHSA-9g3c-x747-c6wr · AI agents & MCP
FIX → 0.31.0
A client sending an image chat request to vLLM serving a Cohere2 Vision model can set mm_processor_kwargs.max_patches to a large value, forcing quadratic CPU work during preprocessing. This lets an attacker slow or deny service to other clients, with no code execution or data exposure demonstrated.
first public Oct 27, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running vLLM's Python OpenAI-compatible server with a Cohere2 Vision model, where clients can send image chat requests. The default server has no API key, so any reachable client can trigger it; deployments with API authentication limit this to authorized clients. Deployments not serving Cohere2 Vision models are not affected.
Not affected if api-auth-with-trusted-clients, no-cohere2-vision-model, version-0.31.0-or-later
Who cares llm-serving, python, self-hosted, vllm
pip show vllm or python -c "import vllm; print(vllm.__version__)"; versions from >= 0.10.1 and below 0.31.0 are affected.mm_processor_kwargs from untrusted clients; the advisory says --trust-request-mm-kwargs should stay disabled for them.The Python OpenAI-compatible server accepts a request-controlled
mm_processor_kwargs.max_patches value when serving Cohere2 Vision models.
vLLM forwards the value to the Hugging Face processor without applying a
server-side upper bound. The processor enumerates candidate tile aspect ratios
with two loops whose bounds are both controlled by max_patches, causing
quadratic CPU work before normal inference limits can protect the service.
A client that can access the chat-completions endpoint can submit a small,
valid image together with a large max_patches value. Varying the value across
requests also avoids reuse of the helper's small LRU cache. This can occupy
multimodal preprocessing workers, substantially increase request latency, and
deny service to other clients.
No code execution, confidentiality impact, or integrity impact was demonstrated.
The issue was rechecked on 2026-09-08 against the then-current upstream
main commit:
f6326f53bda46898a331c2d24500332c285d9a2b
Commit permalink: https://github.com/vllm-project/vllm/commit/f6326f53bda46898a331c2d24500332c285d9a2b
The original audited revision was:
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 0.31.0
vllm to 0.31.0 or later.--trust-request-mm-kwargs disabled for untrusted clients (per PR #58830, untrusted per-request mm_processor_kwargs are blocked by default).7ca49fbe4bab019e55d57cdc4b7fd3d55c67c1a6
The vulnerable data flow was present at the revision assessed in this report.
max_patches is a computational budget, but the Python serving path lets a
remote request choose it. The expensive enumeration occurs during request
preprocessing, before the request reaches normal model execution. A small
request body can therefore trigger work disproportionate to its size.
The default server does not require an API key. If an operator configures API authentication, exploitation instead requires a client authorized to call the affected endpoint.
mm_processor_kwargs.max_patches.No special build flag, remote model code, malformed image, or unsafe runtime option is required. The issue is model-specific and is not a claim that every vLLM deployment is affected.
The request-to-sink chain at the confirmed revision is:
ChatCompletionRequest.mm_processor_kwargs is an unrestricted
dict[str, Any]:
https://github.com/vllm-project/vllm/blob/f6326f53bda46898a331c2d24500332c285d9a2b/vllm/entrypoints/openai/chat_completion/protocol.py#L372-L375OnlineRenderer.preprocess_chat copies the request value into both the chat
parameters and prompt extras:
https://github.com/vllm-project/vllm/blob/f6326f53bda46898a331c2d24500332c285d9a2b/vllm/renderers/online_renderer.py#L675-L704BaseRenderer applies the extras and constructs MMProcessorInputs with
the same processor kwargs:
https://github.com/vllm-project/vllm/blob/f6326f53bda46898a331c2d24500332c285d9a2b/vllm/renderers/base.py#L769-L779
https://github.com/vllm-project/vllm/blob/f6326f53bda46898a331c2d24500332c285d9a2b/vllm/renderers/base.py#L846-L880Cohere2VisionProcessingInfo.get_num_patches passes the merged mapping to
get_number_of_image_patches without bounding max_patches:
https://github.com/vllm-project/vllm/blob/f6326f53bda46898a331c2d24500332c285d9a2b/vllm/model_executor/models/cohere2_vision.py#L170-L188get_number_of_image_patches reads
max_patches from that mapping and calls get_optimal_tiled_canvas:
https://github.com/huggingface/transformers/blob/v5.16.1/src/transformers/models/cohere2_vision/image_processing_cohere2_vision.py#L257-L285The relevant operation is equivalent to:
for width in range(1, max_image_tiles + 1):
for height in range(1, max_image_tiles + 1):
if width * height <= max_image_tiles:
aspect_ratios.append((width, height))
The nested loops perform Theta(max_patches squared) iterations. The helper
has an LRU cache of only ten argument values, so requests using distinct large
values continue to force cold computations.
Request-level processor overrides must not be able to raise a server-owned preprocessing budget beyond a safe configured limit. An excessive value should be rejected before invoking the Hugging Face processor.
A remote or API-authorized caller can consume disproportionate CPU time in the multimodal preprocessing path. Repeated cold computations can delay image requests and reduce or deny availability for other clients. The demonstrated impact is limited to availability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LPR:N reflects the default server configuration without an API key. An
authenticated deployment changes the required access conditions, and the vLLM
team should assign the final severity and version range.
On 2026-09-08, public vLLM issues, pull requests, and published GitHub Security
Advisories were searched using combinations of max_patches, Cohere2 Vision, get_all_supported_aspect_ratios, mm_processor_kwargs, quadratic,
and denial of service. No public report with this specific model, request
parameter, and root cause was found.
Private vulnerability reports are not searchable, so this does not rule out a private duplicate.
max_patches values that are not strict positive
integers or that exceed that server-owned limit.Please handle this report through vLLM's private vulnerability-reporting workflow. No public issue or pull request has been created for this finding. The reporter can provide additional source traces or help validate a proposed fix. Public disclosure and any public remediation pull request should follow the maintainers' triage and coordination guidance.
vllm (PyPI).>= 0.10.1, < 0.31.0.0.31.0.PR #58830 blocks untrusted per-request mm_processor_kwargs and media_io_kwargs by default before preprocessing. Keep --trust-request-mm-kwargs disabled for untrusted clients. Explicitly enabling it restores trusted override behavior; the underlying processor/sampler is not independently bounded by this fix.
Advisory fixed in #58830.