CVE-2026-37237 in vLLM
Summary
by MITRE • 08/28/2026
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read() without enforcing a maximum response size, allowing an attacker to exhaust server memory by providing a URL to an arbitrarily large file.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in vLLM versions up to 0.17.0 represents a critical resource exhaustion flaw within the multimodal input processing subsystem. Specifically, the AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions are designed to retrieve media content from user-supplied Uniform Resource Locators using the aiohttp asynchronous HTTP client library. The core technical deficiency lies in the absence of any mechanism to limit or validate the size of the incoming data stream before it is fully loaded into memory. When these endpoints receive a request containing a URL pointing to an arbitrarily large file, the application proceeds to read the entire response body into RAM via the r.read() method without checking for length constraints. This design oversight transforms standard media fetching functionality into a potent vector for resource depletion attacks.
From an operational perspective, this flaw allows remote attackers to trigger a Denial of Service condition by exhausting the server's available memory resources. Since vLLM is often deployed in production environments handling high volumes of inference requests, the allocation of excessive memory due to large media payloads can lead to process crashes or system-wide instability. The attack does not require authentication if these endpoints are accessible without strict access controls, and even with authentication, a single malicious request from an authorized user could destabilize the service for all other users by consuming critical heap space. This impacts the availability of the AI inference services, which is a primary component of the CIA triad in information security.
The technical nature of this vulnerability aligns closely with CWE-400, Uncontrolled Resource Consumption, as the application fails to properly control the allocation and retention of system resources based on external input. Furthermore, it can be classified under CWE-787 Out-of-bounds Write if the memory exhaustion leads to buffer overflows in underlying C++ extensions used by vLLM for tensor operations, although the primary manifestation is resource depletion rather than code execution. In terms of adversary tactics, this behavior corresponds to MITRE ATT&CK technique T1496 Resource Hijacking, where attackers leverage compromised or vulnerable systems to consume resources, potentially causing service degradation or denial of service without necessarily gaining persistent access or exfiltrating data.
Mitigation strategies must focus on implementing strict input validation and resource limits within the media fetching logic. Developers should enforce a maximum response size limit when using aiohttp by configuring the max_size parameter in the read operations or by streaming large files to disk rather than loading them entirely into memory. Additionally, integrating rate limiting and quota management at the API gateway level can help mitigate the impact of such attacks by restricting the frequency and volume of media requests per user session. Upgrading to a patched version of vLLM that addresses this specific flaw in the AsyncMediaIO implementation is the most effective remediation step for existing deployments.