Disclosed weakness · no CVE recorded

vLLM can exhaust frontend resources while fetching many images for one request

vLLM · Python multimodal inference frontend

First documented disclosure · Review checkpoint

Summary

Many images that pass individual limits can consume the service budget together.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: A bounded proof of concept demonstrated resource allocation. The report did not establish a production outage or malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The frontend fetches and decodes allowed media concurrently, retaining the resulting images before enforcing prompt length. Per-image checks leave total download size and decoded memory unbounded per request.

Conditions required

A remote client can submit multimodal inference requests to a model that accepts multiple images. Protected deployments require inference access.

Potential impact

Network connections, processing time and memory can be exhausted. The bounded reproduction demonstrated resource retention without forcing an out-of-memory crash.

Affected versions and configurations

0.6.0 through versions before 0.33.0, according to vLLM.

Fix and mitigation status

0.33.0 according to vLLM. The fix adds aggregate download and decoded-media budgets to the Python frontend.

Practical next steps

Upgrade to a release containing 0.33.0 and set the request-wide download and decode limits for available frontend capacity.

Operating lesson

Limit the total cost of one request before fetching and expanding its individual media items.

Evidence and limits

Public fix proposal October 12, detailed maintainer advisory November 2. The fix PR excludes the optional Rust frontend and offline user-code helpers. The reviewed advisory does not assign a CVE.

Sources