The Pulse
Three High-Severity vLLM Flaws Expose Serving Systems to Remote Attacks
Three high-severity vLLM advisories describe conditional risks ranging from command execution through an EPS image to memory exhaustion in multimodal deployments. The advisories identify affected versions and patched releases, with one warn
AI.info Team · Written with AI · fact-checked ·
A high-severity vLLM security advisory warns of a path from an uploaded image to command execution, but only on servers with a vulnerable Ghostscript installation. Published October 20, the advisory rates the issue 8.1 and says the affected vLLM release is 0.30.0; it lists 0.32.0 as patched. Two other high-severity advisories published in October describe remote memory-exhaustion risks in multimodal deployments, where the attack depends on which model and endpoint an operator serves.
EPS files cross an image boundary
The October 20 flaw concerns vLLM’s image loader, which passes supplied image bytes to Pillow without restricting the accepted formats. The request’s MIME label does not determine which decoder handles the bytes: an EPS file labeled as PNG can still be recognized as EPS and routed through Pillow’s Ghostscript processing path. The advisory describes a chain in which a known Ghostscript vulnerability, CVE-2024-29510, can then enable commands to run with the vLLM process’s privileges.
The advisory states:
Exploitation requires an image-capable request path, a caller able to reach it under the deployment's authentication policy, and a vulnerable host Ghostscript build.
— jperezdealgaba, the advisory’s publisher
Ghostscript is not a declared vLLM dependency, so the command-execution path requires a vulnerable executable supplied by the host or deployment image. The advisory says the loader-level behavior was reproduced with vLLM 0.30.0, but the HTTP request path was traced in source rather than tested end to end; it does not claim a new Ghostscript vulnerability.
Two more flaws target multimodal memory
A separate October 6 advisory rates request-controlled mm_processor_kwargs as high severity, with a CVSS score of 7.5. In affected multimodal processors, clients can supply values such as image size, patch count, crop count or frame count, which vLLM forwards to processor code. The advisory says a single request can trigger enough CPU or GPU memory allocation to terminate the API server or worker; it lists versions from 0.7.3 onward as affected and 0.31.0 as the first patched release.
The same advisory names processors derived from Isaac, InternVL and H2OVL, among others, but says the weakness lies in the shared remote-input boundary rather than a fixed list of models. Its proposed fix rejects non-empty per-request processor overrides by default. Operators serving trusted clients can explicitly opt back into that behavior, while server-level configuration and offline LLM overrides remain available.
A second October 6 report is narrower: it applies to vLLM deployments serving MOSS-Audio. The advisory says clients can send distinct processor settings to the /tokenize endpoint, causing vLLM to retain new processor instances and their mel-filter arrays. Oversized settings can also amplify a single allocation; versions greater than 0.24.0 and below 0.31.0 are listed as affected, with 0.31.0 and later patched.
API keys do not cover every route
The MOSS-Audio issue highlights a deployment detail: the advisory says /tokenize sits outside vLLM’s API-key-protected route prefixes, so setting --api-key alone does not restrict access to it. It says a reverse proxy that authenticates or rate-limits requests to the endpoint can reduce exposure.
These advisories describe different conditions, not a single universal exploit against every vLLM installation. The EPS issue hinges on a particular release, an image-processing route and vulnerable host software; the other two depend on multimodal request handling and, for the MOSS-Audio flaw, a specific model and exposed endpoint. Operators can use the listed patched releases—0.32.0 for the EPS advisory and 0.31.0 for the two October 6 advisories—as the concrete update targets.