CVE-2026-126397: vLLM 0.10.1 before 0.31.0 Cohere2 Vision DoS via max_patches
vLLM from 0.10.1 before 0.31.0 forwards a request-controlled mmprocessorkwargs.maxpatches value to the Hugging Face processor for Cohere2 Vision models without a server-side upper bound, causing quadratic CPU work during multimodal preprocessing. Remote clients can send small image chat-completion requests with large, varying maxpatches values to bypass the LRU cache, exhaust preprocessing workers, and deny service to other clients.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments running vLLM versions from 0.10.1 up to, but not including, 0.31.0 are affected when serving Cohere2 Vision models. The vulnerable path is reachable through multimodal chat-completion requests.
What does an attacker need to exploit it?
An attacker only needs network access to send chat-completion requests; no privileges or user interaction are required. They can use small image requests with large, varying mm_processor_kwargs.max_patches values to create quadratic preprocessing CPU work and evade the LRU cache.
Does exploitation require a non-default server configuration?
The available information does not identify any required non-default configuration. The issue arises because the server forwards the request-controlled max_patches value without applying a server-side upper bound.
What should be done if patching cannot happen immediately?
Apply a server-side upper bound to mm_processor_kwargs.max_patches so client requests cannot select arbitrarily large values. Restricting access to the affected chat-completion endpoint can also reduce exposure while remediation is pending.