AI Threat AlertCVE-2026-116177: vLLM: decompression bomb in Nemotron-VL causes DoS
HIGHvLLM versions 0.10.2 up to (but not including) 0.25.0 disable Pillow's decompression-bomb guard globally when the Nemotron-VL image processors load, so a single crafted image sent to /v1/chat/completions can exhaust memory and OOM-kill the inference worker. The attack is unauthenticated over the network with low complexity (CVSS 7.5, availability impact only), and on shared inference servers it takes down every co-tenant's service at once. There is no EPSS score, no CISA KEV listing, no public exploit and no Nuclei template yet, so active exploitation is not evidenced, but a decompression bomb is trivial to build and the advisory is public. Upgrade to vLLM 0.25.0 or later; if you cannot patch immediately, put authentication, image size limits and memory limits in front of any exposed vLLM endpoint that serves Nemotron-VL models.
What is the risk?
Rated high (CVSS 7.5) because exploitation needs no authentication, no user interaction and little skill, and the effect is a complete loss of availability for the worker. Impact is limited to availability, with no confidentiality or integrity loss. Likelihood rises with exposure: internet-facing or shared multi-tenant vLLM deployments serving Nemotron-VL models are most at risk. No EPSS data, KEV listing or public exploit exists at this time, so the exploitation likelihood is unquantified but plausibly moderate given the simplicity of the technique. The flaw is also easy to repeat, so an attacker can keep knocking the service down after each restart.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| vLLM | pip | — | No patch |
Do you use vLLM? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade vLLM to 0.25.0 or later. 2) Until patched, require authentication (API gateway, reverse proxy or API keys) on /v1/chat/completions and do not expose it to the internet. 3) Enforce maximum request body size and maximum image dimensions and pixel counts at the proxy or gateway, and reject images that exceed them before they reach vLLM. 4) Set container or cgroup memory limits and restart policies, and isolate tenants onto separate workers where feasible. 5) Detection: alert on OOM-kill events, sudden worker restarts and memory spikes on vLLM hosts, and review logs for unusually large or highly compressed image payloads. 6) If Nemotron-VL is not in use, check that the affected processors are not loaded on that deployment.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-116177?
vLLM versions 0.10.2 up to (but not including) 0.25.0 disable Pillow's decompression-bomb guard globally when the Nemotron-VL image processors load, so a single crafted image sent to /v1/chat/completions can exhaust memory and OOM-kill the inference worker. The attack is unauthenticated over the network with low complexity (CVSS 7.5, availability impact only), and on shared inference servers it takes down every co-tenant's service at once. There is no EPSS score, no CISA KEV listing, no public exploit and no Nuclei template yet, so active exploitation is not evidenced, but a decompression bomb is trivial to build and the advisory is public. Upgrade to vLLM 0.25.0 or later; if you cannot patch immediately, put authentication, image size limits and memory limits in front of any exposed vLLM endpoint that serves Nemotron-VL models.
Is CVE-2026-116177 actively exploited?
No confirmed active exploitation of CVE-2026-116177 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-116177?
1) Upgrade vLLM to 0.25.0 or later. 2) Until patched, require authentication (API gateway, reverse proxy or API keys) on /v1/chat/completions and do not expose it to the internet. 3) Enforce maximum request body size and maximum image dimensions and pixel counts at the proxy or gateway, and reject images that exceed them before they reach vLLM. 4) Set container or cgroup memory limits and restart policies, and isolate tenants onto separate workers where feasible. 5) Detection: alert on OOM-kill events, sudden worker restarts and memory spikes on vLLM hosts, and review logs for unusually large or highly compressed image payloads. 6) If Nemotron-VL is not in use, check that the affected processors are not loaded on that deployment.
What systems are affected by CVE-2026-116177?
This vulnerability affects the following AI/ML architecture patterns: model serving, multimodal LLM inference, multi-tenant inference platforms, OpenAI-compatible API gateways.
What is the CVSS score for CVE-2026-116177?
CVE-2026-116177 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.29%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0029Denial of AI ServiceAML.T0034.001Resource-Intensive QueriesAML.T0040AI Model Inference API AccessAML.T0049Exploit Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker and deny service to co-tenants.
Exploitation Scenario
An attacker finds an exposed vLLM endpoint serving a Nemotron-VL model, or a public chatbot built on one. They craft a small PNG whose declared dimensions are extremely large but which compresses to a few kilobytes, then embed it as a base64 image_url in a chat completion request. Because the pixel limit has been disabled, Pillow decodes the full image into memory, the worker runs out of RAM and is OOM-killed, and every co-tenant's in-flight and queued requests fail. The attacker repeats the request each time the worker restarts to sustain the outage.
Weaknesses (CWE)
CWE-400 — Uncontrolled Resource Consumption: The product does not properly control the allocation and maintenance of a limited resource.
- [Architecture and Design] Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
- [Architecture and Design] Mitigation of resource exhaustion attacks requires that the target system either: The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker. recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-6173210.0Decepticon: ChatML token injection yields sandbox RCE
Same package: vllmCVE-2024-110419.8vllm: RCE via unsafe pickle deserialization in MessageQueue
Same package: vllmCVE-2025-472779.8vLLM: RCE via exposed TCPStore in distributed inference
Same package: vllmCVE-2026-259609.8vllm: SSRF allows internal network access
Same package: vllmCVE-2024-90539.8vllm: RCE via unsafe pickle deserialization in RPC server
Same package: vllm