CVE-2026-114055: Uncontrolled Resource Consumption in vLLM via Unvalidated Multimodal Kwargs

Vulnerability ID: CVE-2026-114055

CVSS Score: 7.5

Published: 2026-10-23

vLLM prior to version 0.31.0 contains an uncontrolled resource consumption vulnerability (CWE-400) in its HTTP API request handling logic. Unauthenticated remote attackers can transmit per-request keyword arguments ( mm_processor_kwargs and media_io_kwargs ) that are passed directly into internal multimodal preprocessing pipelines, causing CPU/GPU memory exhaustion and crashing the engine process.

TL;DR

Unauthenticated remote attackers can crash vLLM multimodal inference instances by supplying extreme keyword parameters in API requests, leading to Out-Of-Memory termination and Denial of Service.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-400

Attack Vector : Network (Unauthenticated)

CVSS v3.1 : 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

EPSS Score : 0.00343 (26.67th percentile)

Impact : Denial of Service (Process…