CVE-2026-116177 vllm-project CVE debrief

Who should care

Defenders responsible for vLLM deployments, particularly those using versions 0.10.2 to 0.24.0, should assess their exposure and apply the patch to version 0.25.0 or later. This vulnerability could impact the availability of the service, leading to denial-of-service conditions for co-tenants.

Why it matters

CVE-2026-116177 is an uncontrolled resource consumption vulnerability in vLLM that allows unauthenticated attackers to exhaust memory, potentially denying service to co-tenants. Defenders should verify vLLM deployments for versions 0.10.2 to 0.24.0 and apply patches to version 0.25.0 or later to mitigate this vulnerability.

• Denial of service to co-tenants due to memory exhaustion.
• Potential for unauthenticated attackers to disrupt service.
• Need for verification of vLLM version and application of patches.
• Possible impact on service availability and co-tenant stability.

Technical summary

The vLLM library from version 0.10.2 to 0.24.0 contains an uncontrolled resource consumption vulnerability. This vulnerability allows unauthenticated attackers to exhaust memory by submitting a pathological decompression-bomb image to the /v1/chat/completions endpoint, potentially causing a denial-of-service (DoS) attack on co-tenants. The vulnerability is due to the Nemotron-VL processors globally setting Image.MAX_IMAGE_PIXELS to None.

Defensive priority

Defenders should prioritize verifying vLLM deployments for version 0.10.2 to 0.24.0 and applying the patch to version 0.25.0 or later.

Recommended defensive actions

• Verify vLLM deployments for version 0.10.2 to 0.24.0 and apply the patch to version 0.25.0 or later.
• Monitor /v1/chat/completions for unusual traffic patterns that could indicate an attempted denial-of-service attack.
• Implement rate limiting on /v1/chat/completions to prevent abuse.
• Consider using a Web Application Firewall (WAF) to detect and prevent malicious traffic.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability allows unauthenticated attackers to exhaust memory by submitting a pathological decompression-bomb image to /v1/chat/completions, potentially denying service to co-tenants. Affected versions are from 0.10.2 to 0.24.0, and the fix is in version 0.25.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.