vLLM, the open-source inference engine behind a large share of production language-model deployments, has patched an unauthenticated memory-exhaustion flaw in its Nemotron-VL multimodal processor. The vulnerability, CVE-2026-116177, is rated high severity at CVSS 7.5 and affects every release from 0.10.2 through 0.24.x; the fix is in version 0.25.0, publicly disclosed on 25 October 2026.

How the flaw works

The flaw is in the Nemotron-VL processor, which globally sets the image size limit on initialisation. That global assignment means any request routed through that code path can trigger memory allocation without bound. An unauthenticated caller can therefore exhaust server memory through crafted multimodal input, bringing the inference service down without ever establishing credentials. No user interaction is required, and the flaw does not by itself give privilege escalation.

Why GPU hosts raise the stakes

The operational risk is higher than the score alone suggests because vLLM typically runs on high-memory GPU hosts, where an out-of-memory kill and service restart is more disruptive than taking down an ordinary web server, and inference jobs often cannot be queued and resumed cleanly. In many production setups the vLLM API sits on an internal port under a trust-the-network assumption, with application-layer authentication above it, an architecture that holds only while the network perimeter holds. No public exploit code has been confirmed for this flaw, and it is not recorded in CISA's Known Exploited Vulnerabilities catalogue, according to the threat-intelligence summary. Operators should still upgrade to 0.25.0, and check for other unpatched vLLM components, rather than waiting for exploitation to be observed.