vLLM Patches High-Severity DoS Flaw in Multimodal Pipeline

vLLM disclosed CVE-2026-114055, a high-severity denial-of-service vulnerability allowing remote API clients to supply arbitrary mm_processor_kwargs per request, controlling resource-sensitive values such as image size, patch count, and frame count¹. A single crafted request can force memory allocations large enough to crash the API server or worker process. The flaw affects vLLM versions 0.7.3 through 0.30.x across multiple multimodal processors including Isaac, InternVL, H2OVL, Step3VL, and NemotronVL, and is patched in version 0.31.0.