CVE-2026-100650
Description
A flaw was found in vLLM. The system fully downloads and decodes remote or embedded media files before enforcing configured size and quantity restrictions. A remote attacker can exploit this vulnerability by submitting requests containing excessively large or numerous media payloads, forcing the server to consume excessive memory and network bandwidth. This resource exhaustion can lead to a Denial of Service (DoS), rendering the service unresponsive or causing it to crash.
Statement
This vulnerability is rated as an Important severity flaw because it can be triggered remotely without authentication to crash the inference service via resource exhaustion, completely disrupting model serving availability. In Red Hat Enterprise Linux AI and OpenShift AI environments, deployments hosting vLLM handle multi-modal requests or tokenization operations where input acquisition occurs prior to applying payload size constraints. Because excessive system memory and outbound bandwidth can be consumed before request rejection occurs, an adversary can exhaust container resources, though the flaw does not allow code execution or data exposure.
Mitigation
Limit network exposure to the vLLM inference service and block outbound network connections from the serving host or container to prevent fetching untrusted external media:
1. Restrict inbound access using firewall rules so only trusted client networks or API gateways can reach the inference port (e.g., port 8000):
# firewall-cmd --zone=public --remove-port=8000/tcp --permanent
# firewall-cmd --zone=trusted --add-source=<TRUSTED_IP_OR_CIDR> --permanent
# firewall-cmd --reload
2. In OpenShift AI environments, apply a Kubernetes NetworkPolicy to the pod namespace to restrict ingress traffic strictly to authorized proxy pods, and apply an egress rule that blocks outbound internet access, preventing the service from downloading arbitrary remote media URLs.
3. Enforce maximum request body size limits on upstream reverse proxies or ingress controllers to drop oversized inline base64 payloads before forwarding requests to the inference backend.
Caveats:
Restricting egress traffic will prevent valid remote media references from being processed if external multi-modal inputs are expected. Modifying firewall rules or reloading network services may briefly interrupt active connections.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
