CVE-2026-114055 Overview
CVE-2026-114055 is an uncontrolled resource consumption vulnerability in vLLM, an open-source inference and serving engine for large language models. The flaw affects versions from 0.7.3 before 0.31.0. Remote clients can control multimodal processor parameters by supplying per-request mm_processor_kwargs values. Attackers can submit oversized image size, patch count, crop count, or frame count values targeting Isaac, InternVL, H2OVL, and other multimodal processors. These values force the server to allocate excessive memory and terminate the shared inference process. The weakness is tracked under [CWE-400: Uncontrolled Resource Consumption].
Critical Impact
Any unauthenticated client with network access to a vulnerable vLLM endpoint can exhaust server memory and crash a shared multi-tenant inference service with a single crafted request.
Affected Products
- vLLM versions from 0.7.3 up to but not including 0.31.0
- Deployments exposing Isaac, InternVL, or H2OVL multimodal model processors
- Shared or multi-tenant vLLM inference servers accepting user-controlled mm_processor_kwargs
Discovery Timeline
- 2026-10-21 - CVE-2026-114055 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-114055
Vulnerability Analysis
vLLM accepts a mm_processor_kwargs field on multimodal requests. This field is forwarded directly into the model-specific multimodal processor without bound checks. For processors such as Isaac, InternVL, and H2OVL, these kwargs include parameters that scale memory allocation linearly or quadratically. Values such as image dimensions, patch count, crop count, and video frame count control tensor sizes allocated during preprocessing. A single request with large values triggers allocations that exceed available host or GPU memory. The out-of-memory condition terminates the shared server process, denying service to every connected tenant.
Root Cause
The root cause is missing server-side validation of client-supplied processor parameters. The multimodal request path trusts the request body and forwards processor kwargs into tensor-shape calculations. No upper bound, allowlist, or server-side override is enforced. Because vLLM runs a shared worker across tenants, any single abusive request impacts all users of the deployment.
Attack Vector
The attack is network-reachable, requires no authentication, and no user interaction. An attacker sends a crafted HTTP request to the vLLM OpenAI-compatible API endpoint. The request references a multimodal model and includes a mm_processor_kwargs object with inflated values for parameters such as image_size, num_patches, max_num_crops, or num_frames. The server attempts to preallocate buffers for the declared shape and exhausts memory. See the GitHub Security Advisory GHSA-gx7p-2j49-hfq4 and the VulnCheck Advisory for vllm 0.7.3 for additional detail.
Detection Methods for CVE-2026-114055
Indicators of Compromise
- Repeated inference requests containing mm_processor_kwargs with unusually large numeric values for image_size, num_patches, max_num_crops, or num_frames.
- vLLM worker processes terminating with out-of-memory signals or CUDA allocation failures shortly after a multimodal request.
- Unexpected restarts of the vLLM server coinciding with inbound traffic from a single client or IP range.
Detection Strategies
- Inspect reverse-proxy or API gateway logs for multimodal request bodies and flag outlier parameter values in mm_processor_kwargs.
- Correlate container or systemd restart events for the vLLM service with the preceding HTTP request to identify triggering payloads.
- Monitor host and GPU memory utilization for sharp spikes immediately before worker termination.
Monitoring Recommendations
- Export vLLM metrics such as vllm:request_prompt_tokens and GPU memory counters to a central observability stack.
- Alert on repeated 5xx responses or process restarts tied to multimodal endpoints.
- Capture full request bodies for multimodal endpoints at the edge to support post-incident analysis.
How to Mitigate CVE-2026-114055
Immediate Actions Required
- Upgrade vLLM to version 0.31.0 or later across all inference deployments serving multimodal models.
- Restrict network exposure of the vLLM API to authenticated internal clients until the upgrade is complete.
- Audit application code that forwards client input into vLLM to confirm mm_processor_kwargs is not passed through untrusted paths.
Patch Information
The fix is included in vLLM 0.31.0. The upstream patch validates and bounds multimodal processor parameters so that client-supplied values cannot drive unbounded memory allocation. Full remediation details are published in GitHub Security Advisory GHSA-gx7p-2j49-hfq4.
Workarounds
- Strip or override the mm_processor_kwargs field at an API gateway or reverse proxy before requests reach vLLM.
- Enforce request-size limits and per-client rate limits on multimodal endpoints to constrain blast radius.
- Run separate vLLM worker pools per tenant so that a crash from one client does not affect others.
- Place vLLM behind an authenticating proxy and deny anonymous access to multimodal model routes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
