ghsa:GHSA-3CGQ-C484-RX5J: vllm >= 0.7.3, < 0.31.0

Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs. Affected range: >= 0.7.3, < 0.31.0.

Affected technology

vllm · >= 0.7.3, < 0.31.0
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server. Source advisory’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high.

Published 24-Oct-2026 01:47 UTC

Product: vllm
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-24 01:45:06.114611+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-3cgq-c484-rx5j.html