CyberRota Analysis
AI-GeneratedThe vLLM versions up to and including 0.17.0 are vulnerable to a Denial of Service attack due to memory exhaustion caused by the AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions. These functions do not impose a limit on the size of user-supplied media URLs, enabling attackers to exploit this weakness by providing links to excessively large files, which can overwhelm server resources. Organizations utilizing vLLM should prioritize patching or implementing mitigations to prevent potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read() without enforcing a maximum response size, allowing an attacker to exhaust server memory by providing a URL to an arbitrarily large file.