Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-100650— vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization

Quick assessment

Affected
vllm-project vllm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

vLLM 0.29.0 及之前版本在强制执行其文档中规定的媒体控制策略（即 VLLM_MAX_AUDIO_CLIP_FILESIZE_MB 压缩音频文件大小上限，默认值为 25 MB，以及按模态划分的每个提示词媒体项数量限制 --limit-mm-per-prompt）之前，会先获取并完整还原（materialize）远程或内联嵌入的媒体内容。 具体而言，在以下四个入口路径中： 1. 共享媒体获取层（HTTPConnection.get_bytes()/async_get_bytes()）； 2. chat com

CVSS 6.5 · Medium EPSS 0.61% · P47
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-100650

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization
Source: CVE Program / CVE List V5
Vulnerability Description
vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits). Across four ingress paths — the shared media-acquisition layer (HTTPConnection.get_bytes()/async_get_bytes()), the chat completions audio_url/base64 path, the batch speech runner, and the Rust frontend POST /tokenize route — the server reads the entire HTTP response body, base64-decodes the inline payload, or spawns one fetch/decode task per media part, and only then applies the limit (or, on some paths, never applies it). A remote attacker can therefore cause the API server or batch-runner process to allocate memory and consume outbound bandwidth proportional to an attacker-chosen body size or media item count before the request is rejected, resulting in pre-inference memory and bandwidth exhaustion (denial of service). The chat and batch surfaces require an API key when one is configured; the Rust frontend /tokenize route is unauthenticated by design. There is no code execution or data disclosure impact.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
vllm-project vllm 0 ~ 0.29.0 -

II. Public POCs for CVE-2026-100650

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-100650

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-100650 (1)

Other References for CVE-2026-100650 (2)

Same Patch Batch · vllm-project · 2026-09-26 · 8 CVEs total

CVE-2026-100654 6.5 MEDIUM vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids
CVE-2026-100651 6.5 MEDIUM vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass
CVE-2026-100653 6.5 MEDIUM vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation
CVE-2026-100652 5.9 MEDIUM vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids
CVE-2026-100647 5.3 MEDIUM vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt
CVE-2026-100648 5.3 MEDIUM vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding
CVE-2026-100649 3.7 LOW vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

IV. Related Vulnerabilities

Same product: vllm
Same vendor: vllm-project
Same weakness: CWE-400

V. Comments for CVE-2026-100650

No comments yet

Leave a comment