CVE-2026-115915
Description
A flaw was found in vLLM. The application processes user-supplied image data without restricting accepted file formats or verifying that the content matches the declared media type. A remote attacker can exploit this vulnerability by submitting a specially crafted image, such as an Encapsulated PostScript (EPS) file, to an image-handling endpoint. Depending on the host environment and installed image processing tools, this can result in arbitrary code execution or a Denial of Service (DoS) through resource exhaustion.
Statement
This vulnerability is rated as an Important severity flaw because successful exploitation can lead to remote code execution or denial of service within the model serving container. In Red Hat OpenShift AI and Red Hat Enterprise Linux AI, the risk is contingent upon deploying multimodal inference endpoints that ingest untrusted image data. Furthermore, achieving command execution requires vulnerable host or container libraries, such as an unpatched Ghostscript binary, to be present alongside the inference engine. Deployments serving strictly text-based language models or those isolated behind authenticated network boundaries are not exposed to this flaw.
Mitigation
Restrict access to vLLM inference endpoints and remove unnecessary image processing binaries from the environment:
1. Restrict service reachability:
Limit network access to the inference service port (such as TCP port 8000) to allow requests only from authenticated and trusted systems. Using firewalld on a standalone host:
`firewall-cmd --zone=trusted --add-source=<TRUSTED_IP_RANGE> --permanent`
`firewall-cmd --zone=public --remove-port=8000/tcp --permanent`
`firewall-cmd --reload`
In Red Hat OpenShift AI deployments, apply a Kubernetes NetworkPolicy to the model serving namespace to restrict ingress traffic to trusted gateway components.
2. Remove Ghostscript:
If Ghostscript is installed in the container image or host execution environment, remove the package to eliminate the external interpreter invoked by Pillow when handling EPS data:
`rpm -e --nodeps ghostscript`
3. Input validation:
Configure reverse proxies or ingress gateways in front of vLLM to reject Encapsulated PostScript (EPS) payloads and allow only required image types (such as JPEG and PNG).
Caveats:
Removing Ghostscript prevents the parsing of PostScript/EPS documents, though standard image formats utilized in vision-language models remain unaffected. Modifying network configurations or rebuilding container images requires restarting serving pods or reloading firewall rules, causing temporary service interruption.
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to restrict image decoding in vLLM ImageMediaIO to native raster decoders and eliminate delegation to external interpreters like Ghostscript: upgrade to vLLM 0.32.0 (or the corresponding fixed Red Hat builds), which enforce an allowlist of native in-process raster decoders and reject formats that invoke external renderers, closing all 3 injection vectors (crafted EPS payload via raw image bytes, crafted EPS payload via data URLs, mismatched MIME label concealing PostScript data). Until patched, this is only a concern on Multimodal inference endpoints accepting user-supplied image data — Deployments serving strictly text-based language models are unaffected — so Restrict inference endpoint network access to authenticated systems, remove Ghostscript binaries from host and container environments, and filter non-raster payloads at ingress gateways. These controls limit blast radius and contain exploitation, but they do not fix the underlying unrestricted image format parsing defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1310 File Upload Validation (Content Inspection and Extension Allowlist) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | 9.8 | 8.1 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | High | Low | High |
| Privileges Required | None | None | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | High | High | High |
| Integrity Impact | High | High | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
Arbitrary code execution is possible if an uploaded file is interpreted and executed as code by the recipient. This is especially true for web-server extensions such as .asp and .php because these file types are often treated as automatically executable, even when file system permissions do not specify execution. For example, in Unix environments, programs typically cannot run unless the execute bit is set, but PHP programs may be executed by the web server without directly invoking them on the operating system.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
