CVE-2026-37237 - vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read() without enforcing a maximum response size, allowing an attacker to exhaust server memory by providing a URL to an arbitrarily large file. - 漏洞详情

漏洞描述

相关链接

相关漏洞

• CVE-2026-82333 [高危] CVE-2026-82333 - multer is a middleware for handling multipart/form-da…
• CVE-2026-77037 [高危] CVE-2026-77037 - multer is a middleware for handling multipart/form-da…
• CVE-2026-55520 [未知] CVE-2026-55520 - Protego is a pure-Python robots.txt parser with suppo…
• CVE-2026-55248 [危急] CVE-2026-55248 - plone.app.portlets provides portlets and a Plone-spec…
• CVE-2026-55247 [危急] CVE-2026-55247 - plone.app.event provides the event content type for P…
• CVE-2026-38638 [高危] CVE-2026-38638 - An issue in the with_argv function (/unistd/mod.rs) o…
• CVE-2026-38636 [高危] CVE-2026-38636 - An issue in the seekdir() function (/dirent/mod.rs) o…
• CVE-2026-37237 [高危] CVE-2026-37237 - vLLM up to and including 0.17.0 allows remote attacke…