CVE-2026-116177: vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

Q: Which deployments are exposed to this denial-of-service issue?

vLLM versions from 0.10.2 before 0.25.0 are affected when Nemotron-VL processors are in use. An exposed /v1/chat/completions endpoint allows unauthenticated remote submission of the malicious image.

Q: What does an attacker need to do to trigger the issue?

The attacker needs to send a pathological decompression-bomb image to /v1/chat/completions. No authentication, special privileges, or user interaction is required.

Q: What is the operational impact if exploitation succeeds?

Image processing can exhaust memory and cause the vLLM worker to be OOM-killed. This can deny service to co-tenants using that worker.

Q: How can I determine whether my deployment is affected?

Check whether the deployed vLLM version is 0.10.2 or later but earlier than 0.25.0, and whether Nemotron-VL processors are used. Also determine whether untrusted clients can reach /v1/chat/completions.

Published Oct 25, 2026

Updated

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAXIMAGEPIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker and deny service to co-tenants.

Affected Software

1 affected component

vllm vllm>=0.10.2<0.25.0

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

vLLM versions from 0.10.2 before 0.25.0 are affected when Nemotron-VL processors are in use. An exposed /v1/chat/completions endpoint allows unauthenticated remote submission of the malicious image.

What does an attacker need to do to trigger the issue?

The attacker needs to send a pathological decompression-bomb image to /v1/chat/completions. No authentication, special privileges, or user interaction is required.

What is the operational impact if exploitation succeeds?

Image processing can exhaust memory and cause the vLLM worker to be OOM-killed. This can deny service to co-tenants using that worker.

How can I determine whether my deployment is affected?

Check whether the deployed vLLM version is 0.10.2 or later but earlier than 0.25.0, and whether Nemotron-VL processors are used. Also determine whether untrusted clients can reach /v1/chat/completions.

CVE-2026-116177: vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to do to trigger the issue?

What is the operational impact if exploitation succeeds?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to do to trigger the issue?

What is the operational impact if exploitation succeeds?

How can I determine whether my deployment is affected?