> CVE-2026-37237

« BACK_TO_HOME
PUBLISHED
2026-08-28 16:17
MODIFIED
2026-08-28 16:17
EPSS (Prob. Exploit)
0.73%
Top 46.3%
DATA SOURCES:
NVD 🔗 2026-08-28 FIRST EPSS 🔗 2026-10-25

> DESCRIPTION

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read() without enforcing a maximum response size, allowing an attacker to exhaust server memory by providing a URL to an arbitrarily large file.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (rocm)
Red Hat AI Inference Server 3.2.2 (rocm) is now available.
Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (cuda)
Red Hat AI Inference Server 3.2.2 (cuda) is now available.
Red Hat Security Advisory: Red Hat AI Inference 3.4.6 (rocm)
Red Hat AI Inference 3.4.6 (rocm) is now available.
Red Hat Security Advisory: Red Hat AI Inference 3.4.6 (cuda)
Red Hat AI Inference 3.4.6 (cuda) is now available.
Red Hat Security Advisory: Red Hat AI Inference 3.4.6 (spyre)
Red Hat AI Inference 3.4.6 (spyre) is now available.
Red Hat Security Advisory: Red Hat AI Inference 3.4.6 (cpu)
Red Hat AI Inference 3.4.6 (cpu) is now available.
Red Hat Security Advisory: RHOAI 3.4.5 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI.
Red Hat Security Advisory: RHOAI 3.5.2 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI.

> HISTORIQUE DES MODIFICATIONS

Première apparition
28/08/2026 16:17
Source: NVD
Total des modifications: 0 Dernière mise à jour: 2 months ago

> REFERENCES

https://github.com/vllm-project/vllm/blob/main/vllm/multimodal/inputs.py
https://github.com/vllm-project/vllm/pull/36506
https://s00me00ne.com/cve/cve-2026-37237/
« BACK_TO_HOME