CVE-2026-116177
Description
A flaw was found in vLLM. This flaw allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by exhausting system memory. The vulnerability occurs because the Nemotron-VL processor modules disable the global maximum image pixel limit during image processing. By submitting a specially crafted, highly compressed image to the application programming interface (API), an attacker can trigger excessive memory allocation that terminates the worker process and disrupts service for all users.
Statement
This vulnerability is rated as having Important severity because unauthenticated remote attackers can trigger an out-of-memory crash of inference worker processes by transmitting malicious image payloads across network endpoints without requiring elevated privileges. In Red Hat OpenShift AI and Red Hat Enterprise Linux AI deployments serving vision-language workloads, exhausting host or container memory disrupts service availability for all tenant workloads sharing the affected inference server. However, the flaw is confined to resource exhaustion and denial of service, without enabling arbitrary code execution or data leakage.
Mitigation
Restrict network exposure of the vLLM inference API endpoints so that only authenticated, trusted clients can submit requests, or avoid deploying multimodal Nemotron-VL models that accept image payloads.
For standalone deployments on Red Hat Enterprise Linux AI, configure firewalld to limit access to the inference service port (for example, default port 8000) to authorized source addresses:
# firewall-cmd --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET> --permanent
# firewall-cmd --zone=public --remove-port=8000/tcp --permanent
# firewall-cmd --reload
Warning: Reloading the firewall configuration will momentarily interrupt active network connections.
In containerized environments such as Red Hat OpenShift AI (RHOAI), enforce OpenShift NetworkPolicies to restrict ingress traffic to model-serving pods from trusted namespaces only, and enforce request size limits and client authentication at an upstream ingress controller or API gateway.
Caveats: Restricting endpoint reachability blocks unauthenticated clients from invoking the API. Legitimate clients must connect from trusted networks or authenticate via an upstream proxy.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
