Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-37237: vLLM can run out of memory from large media URLs

CVE-2026-37237 · published 2 months ago

Summary

The vLLM service (versions up to 0.17.0) can be forced to use all its memory when it tries to download audio or image files from URLs provided by users. An attacker can supply a link to a very large file, causing the server to become unresponsive. Upgrade to a newer version or add limits on downloaded file size to prevent this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
vllm	vllm	<= 0.17.0 `cpe:2.3:a:vllm:vllm::::::::`

Original advisory text

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read() without enforcing a maximum response size, allowing an attacker to exhaust server memory by providing a URL to an arbitrarily large file.

References

https://github.com/vllm-project/vllm/blob/main/vllm/multimodal/inputs.py URL
https://s00me00ne.com/cve/cve-2026-37237/ URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/37xxx/CVE-2026-37237... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-37237 Vendor Advisory
https://github.com/vllm-project/vllm/pull/36506 Patch

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-400Uncontrolled Resource Consumption

Timeline

Published28 Aug 2026

Updated4 Nov 2026

First seen28 Aug 2026

Sources

CVE-2026-37237 · NVD

CVE-2026-37237 · OSV

Track software like this

Free during beta