Executive brief
vLLM is an open-source language model serving platform that supports processing images and audio from user-supplied URLs. An attacker can cause the server to crash or become unavailable by providing a URL pointing to an arbitrarily large file, exhausting server memory when the application fetches and loads the entire file without size limits.
Technical details
The vulnerability exists in the AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in vllm/multimodal/inputs.py, which fetch media from user-supplied URLs using aiohttp. The functions call r.read() without enforcing a maximum response size limit, allowing an attacker to provide a URL to an arbitrarily large file and exhaust server memory. The attack requires network access to the vLLM API endpoint and the ability to submit requests with attacker-controlled media URLs. The vulnerability affects vLLM versions up to and including 0.17.0. Mitigation involves implementing maximum response size limits when fetching remote media and restricting allowed media domains via the --allowed-media-domains configuration parameter.
Affected products
- vLLM project vLLM up to and including 0.17.0
Timeline
- 2026-08-28: disclosed
- 2026-08-28: advisory: NVD entry published