vLLM CVE-2026-37237

Exploitation requires that the vLLM instance is serving a multimodal model (one that processes image or audio inputs) so that the AsyncMediaIO code path is reachable. The CVSS vector PR:N confirms no authentication credential is needed at the application layer; any client that can reach the API endpoint can trigger the fetch. The attacker must also control or access an HTTP server capable of streaming a large response - any publicly accessible large file (e.g., a cloud storage bucket) suffices. Exploitation is limited by: (1) deployments that enforce domain allowlisting for media URLs, which is now documented in vLLM's security guide, (2) network-isolated deployments where untrusted clients cannot reach the API port, and (3) text-only deployments where multimodal input processing is inactive. vLLM's own security documentation explicitly warns that the server is not hardened for direct public exposure, meaning well-configured deployments with access controls have materially reduced exposure.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately characterizes the exploitability: the attack requires no authentication, no special timing, and no user interaction beyond submitting a well-formed API request. Attack complexity is genuinely low because any HTTP server hosting a large file can serve as the weaponized endpoint. The availability impact is high because memory exhaustion can kill the vLLM process or degrade the host. No EPSS score was provided in the input data, so probability-based exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV and no weaponized exploit code is confirmed; a researcher page exists at s00me00ne.com referencing the CVE but its content and reliability have not been independently verified. Real-world risk is tempered by the fact that vLLM's own security documentation recommends network isolation and access control - deployments following these guidance points significantly reduce exposure. Against publicly exposed or inadequately restricted vLLM endpoints serving multimodal models, however, this is a straightforward, reliable denial-of-service primitive.

An attacker with access to the vLLM API endpoint submits a chat completion request containing an image or audio URL that resolves to an HTTP server hosting a multi-gigabyte file. The vLLM server fetches the URL via aiohttp and calls r.read() without any size limit, causing it to buffer the entire response body into process memory. If repeated or sufficiently large, this exhausts available RAM on the inference host, crashing the vLLM process and denying service to all legitimate users.