CVE-2026-37237

vLLM up to and including 0.17.0 is vulnerable to a remote denial-of-service condition caused by uncontrolled memory consumption (CWE-400). The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py download media from user-supplied URLs using aiohttp and call r.read() without enforcing a maximum response size, so the entire remote file is buffered in memory. An attacker with network access to a multimodal endpoint can submit a URL pointing to an arbitrarily large file, causing the server to exhaust memory and crash or become unresponsive; there is no confidentiality or integrity impact, only availability (CVSS 3.1: 7.5, AV:N/PR:N/UI:N, A:H). Any vLLM deployment at version 0.17.0 or earlier that serves multimodal requests accepting attacker-controlled media URLs is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates only a 0.5% probability of exploitation within 30 days.

What to do: Upgrade vLLM to a release newer than 0.17.0 as soon as a patched version is available. Until then, restrict multimodal endpoints to trusted or allowlisted media URLs, enforce a response-size cap (e.g., via a reverse proxy or load balancer limiting upstream response bodies), or disable remote-URL media fetching if it is not required. Audit your deployment to determine whether it exposes endpoints that accept user-supplied media URLs for audio or image inputs.