CVE-2026-37237
Description
A flaw was found in vLLM. Remote attackers can exploit this vulnerability by providing a URL to an excessively large media file. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions, responsible for fetching user-supplied media, do not limit the response size. This oversight allows an attacker to exhaust server memory, leading to a Denial of Service (DoS).
Statement
A flaw was found in the vLLM inference engine as shipped in Red Hat AI Inference Server and Red Hat Enterprise Linux AI. The multimodal input handling does not limit the size of responses downloaded from user-supplied media URLs: the AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in vllm/multimodal/inputs.py fetch URLs provided in requests using aiohttp and read the entire response body into memory without enforcing a maximum size. A remote attacker able to reach the vLLM server, requiring no privileges or user interaction, can submit a request referencing an arbitrarily large media file and exhaust server memory, causing a denial of service. Only availability is affected; there is no impact to confidentiality or integrity. Red Hat rates this Important severity (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), consistent with the CISA assessment. The affected Red Hat products are handled through delegated resolution, with fixes being pursued in the maintained product streams.
Mitigation
Restricting the domains that vLLM is allowed to fetch media from reduces exposure to this issue. Set the `--allowed-media-domains` option to an explicit allowlist of the domains you expect media to come from (for example `--allowed-media-domains upload.wikimedia.org github.com`), so that clients cannot direct the server to download arbitrarily large files from arbitrary hosts. Also consider setting `VLLM_MEDIA_URL_ALLOW_REDIRECTS=0` so that HTTP redirects cannot be followed to bypass the domain restrictions, as recommended in the upstream vLLM security documentation. Note that this restricts which hosts may be fetched but does not by itself impose a limit on the size of responses served by allowlisted domains.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
