GHSA-mm38-5g96-7j6x: vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

Q: Which deployments are most exposed?

vLLM deployments from 0.10.2 before 0.25.0 are affected. Exposure is particularly relevant where unauthenticated users can submit image-containing requests to the /v1/chat/completions endpoint and where worker availability is shared with co-tenants.

Q: What does an attacker need to do to trigger the denial of service?

An attacker needs network access to submit a pathological decompression-bomb image to /v1/chat/completions. No authentication or user interaction is required.

Q: How can operators identify potentially affected instances?

Check whether the installed pip/vllm version is 0.10.2 or later but earlier than 0.25.0, and whether the deployment processes Nemotron-VL image requests. Successful exploitation can OOM-kill a worker, so unexpected worker memory exhaustion or termination after image requests is a relevant indicator.

Published Oct 25, 2026

Updated

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAXIMAGEPIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker and deny service to co-tenants.

Affected Software

1 affected componentFixes available

pip/vllm>=0.10.2<0.25.0

0.25.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/vllm to a version that resolves this vulnerability.
Fixed in 0.25.0

Event History

Oct 25, 2026

CVE Published

via OSV·01:20 PM

Data Sourced

via OSV·01:20 PM

DescriptionSeverityWeakness

Advisory Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

Affected Software

Frequently Asked Questions

Which deployments are most exposed?

vLLM deployments from 0.10.2 before 0.25.0 are affected. Exposure is particularly relevant where unauthenticated users can submit image-containing requests to the /v1/chat/completions endpoint and where worker availability is shared with co-tenants.

What does an attacker need to do to trigger the denial of service?

An attacker needs network access to submit a pathological decompression-bomb image to /v1/chat/completions. No authentication or user interaction is required.

How can operators identify potentially affected instances?

Check whether the installed pip/vllm version is 0.10.2 or later but earlier than 0.25.0, and whether the deployment processes Nemotron-VL image requests. Successful exploitation can OOM-kill a worker, so unexpected worker memory exhaustion or termination after image requests is a relevant indicator.

GHSA-mm38-5g96-7j6x: vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are most exposed?

What does an attacker need to do to trigger the denial of service?

How can operators identify potentially affected instances?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed?

What does an attacker need to do to trigger the denial of service?

How can operators identify potentially affected instances?