vLLM: Denial of service via decompression-bomb image in Nemotron-VL processor

Summary

vLLM, an inference engine for large language models, disables Pillow's decompression-bomb protection for the whole process when the Nemotron-VL processors are imported. An unauthenticated attacker who can reach /v1/chat/completions can submit a crafted image that exhausts memory and OOM-kills the worker, denying service to other tenants. The risk applies to deployments that serve or import Nemotron-VL processors and expose the API.

Affected

• vLLM 0.10.2 to before 0.25.0 (CVE record and VulnCheck)
• The GHSA page lists affected versions as <= 0.8.5; until this is confirmed, treat all versions before 0.25.0 as affected
• Red Hat AI Inference Server is listed as affected; fixed version unknown

Fixed in

• vLLM 0.25.0 and later (the latest release is recommended)
• Backports to older release lines: Unknown.

Workaround

• Unknown from vendor sources.
• Restrict network access to the API endpoint until patched.
• Do not serve Nemotron-VL models until the instance is upgraded.

Exploitation

• CISA SSVC: exploitation none, automatable yes.
• Not in CISA KEV; no exploitation reported as of 25 Oct 2026.
• No public proof of concept found; this is not confirmation that none exists.

Our recommendation

• Inventory all vLLM instances, including container images and Red Hat AI Inference Server.
• Upgrade to vLLM 0.25.0 or later, preferably the latest release.
• Check whether Nemotron-VL models are served, and restrict API access until patched.
• Monitor for worker crashes and memory exhaustion in AI services.
• Read GHSA-mm38-5g96-7j6x directly to confirm the affected range.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-mm38-5g96-7j6x github.com
• VulnCheck advisory: vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor www.vulncheck.com
• OSV: PYSEC-2026-4352 osv.dev
• OffSeq Radar: CVE-2026-116177 radar.offseq.com
• OpenCVE: CVE-2026-116177 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:17.