CVE-2026-37237: n/a

The vulnerability in vLLM up to and including version 0.17.0 involves the AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py. These functions use aiohttp to fetch media from user-supplied URLs and call r.read() without limiting the maximum response size. This lack of size enforcement allows remote attackers to cause memory exhaustion on the server by providing URLs pointing to very large files, resulting in a Denial of Service condition. The CVSS 3.1 base score is 7.5 (high severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

Successful exploitation leads to Denial of Service by exhausting server memory resources, potentially causing application crashes or unresponsiveness. There is no direct impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing controls to limit the size of fetched media responses or restrict the sources of media URLs to trusted domains to mitigate memory exhaustion risks.