{"schema":"threatline.record/2","record":{"id":"GHSA-mm38-5g96-7j6x","aliases":["GHSA-mm38-5g96-7j6x"],"summary":"Nemotron-VL processors disable Pillow decompression-bomb guard globally, enabling unauthenticated DoS","details":"**Summary**\n\n`vllm/transformers_utils/processors/nemotron_vl.py` and `nano_nemotron_vl.py` each set `Image.MAX_IMAGE_PIXELS = None` at module load time, permanently disabling Pillow's process-global decompression-bomb defence. An unauthenticated caller who can reach `/v1/chat/completions` on a vLLM instance that has imported either Nemotron-VL processor can submit a pathological image that decompresses into substantial memory, potentially OOM-killing the worker and denying service to co-tenants. The report was confirmed on vLLM 0.8.5.\n\n**Details**\n\nBoth processor modules set `Image.MAX_IMAGE_PIXELS = None` unconditionally at import time. The module-level side effect disables Pillow's guard for every `Image.open()` call for the lifetime of that process.\n\n`MediaConnector.load_from_url` hands image bytes to `ImageMediaIO.load_bytes`, which opens and decodes the image. With `MAX_IMAGE_PIXELS` set to `None`, Pillow's decompression-bomb limit is disabled for this path.\n\nThe issue was tested on vLLM 0.8.5 / commit `feffb51d3f`; the same sink was observed on main at `1a096d8208`.\n\n**Impact**\n\nA deployment serving a Nemotron-VL model, or one that imports either processor, can be exposed to memory exhaustion through attacker-controlled image input. Since the setting is process-global, unrelated image loads in the same process are affected too. CWE-400 (Uncontrolled Resource Consumption).\n\n**Fix**\n\nPR #47010 removes both module-level `Image.MAX_IMAGE_PIXELS = None` assignments. It also adds a decoded pixel-count limit in the shared image loader, configurable through `VLLM_MAX_IMAGE_PIXELS`.\n","categories":["Unclassified"],"product":"vllm","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-mm38-5g96-7j6x","source_modified_at":"2026-10-09T08:12:07Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"ecosystem":"pip","name":"vllm"},"range":"<= 0.8.5"}],"fixed_versions":[],"cvss":null,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-09T08:12:07Z","modified_at":"2026-10-09T08:12:07Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-mm38-5g96-7j6x","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-09T08:12:07Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-09T08:12:07Z","content_hash":"52281f6e6615917dcbdd89a5a4137629253455b7d8bd4a4e2d08260706f48222"}}