vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-116177 · Microsoft / collected KEV context

cve-program · CVE-2026-116177

• https://github.com/vllm-project/vllm/security/advisories/GHSA-mm38-5g96-7j6x
• https://www.vulncheck.com/advisories/vllm-0.10.2-before-0.25.0-dos-via-nemotron-vl-processor-decompression-bomb-guard-bypass

• vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass · Newly collected advisory · 25 Oct 2026