{"action":"Upgrade vllm to 0.31.0 or later.","affected":[{"fixed":"0.31.0","introduced":"0.7.3"}],"component":"vllm","cve_ids":["CVE-2026-114055"],"ecosystem":"PyPI","epss":0.0042,"exploited":false,"fixed_versions":["0.31.0"],"ghsa_id":"GHSA-gx7p-2j49-hfq4","id":"tcs_01M5NATENH5C59QSWCBHW3FR8C","modified_at":"2026-10-23T21:15:03.776518731Z","published_at":"2026-10-23T20:58:36Z","references":["https://osv.dev/vulnerability/GHSA-gx7p-2j49-hfq4","https://github.com/vllm-project/vllm/security/advisories/GHSA-gx7p-2j49-hfq4","https://nvd.nist.gov/vuln/detail/CVE-2026-114055","https://github.com/vllm-project/vllm/pull/58830","https://github.com/vllm-project/vllm/commit/31f2e70cd3e403aaa471fb7fe3d33a7207aaf3cc","https://github.com/vllm-project/vllm","https://github.com/vllm-project/vllm/releases/tag/v0.31.0","https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-dos-via-unvalidated-mm-processor-kwargs"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-gx7p-2j49-hfq4","url":"https://osv.dev/vulnerability/GHSA-gx7p-2j49-hfq4"}],"summary":"vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)"}