CVE-2026-114055: vLLM Uncontrolled Resource Consumption via Multimodal Parameters

# CVE-2026-114055: vLLM Uncontrolled Resource Consumption via Multimodal Parameters

https://gcdradar.vercel.app/incidents/cve-2026-114055-vllm-uncontrolled-resource-consumption-via-m · AIR-2026-1449 · closed 2026-10-21

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-10-21
- AI role: Attack on AI
- Products: vLLM
- CVE ids: CVE-2026-114055
- CVSS: 7.5

## Summary

An uncontrolled resource consumption vulnerability in vLLM allows remote clients to control multimodal processor parameters and exhaust memory. Attackers can supply oversized values to terminate the shared model serving process.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-23: CVE-2026-114055: vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.) (https://github.com/advisories/GHSA-gx7p-2j49-hfq4)
- 2026-10-21: CVE-2026-114055: vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control… (https://nvd.nist.gov/vuln/detail/CVE-2026-114055)

## Sources

- 2026-10-21 NVD: CVE-2026-114055: vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control… https://nvd.nist.gov/vuln/detail/CVE-2026-114055
- 2026-10-23 GitHub Advisory Database: CVE-2026-114055: vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.) https://github.com/advisories/GHSA-gx7p-2j49-hfq4

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.