The vulnerability resides in vLLM's media input handling functions. These functions fetch media from URLs provided by users and read the entire response into memory without imposing a maximum size. An attacker can supply a link to an enormous file, forcing the process to allocate excessive memory and eventually crash or become unresponsive. The weakness is a resource‑exhaustion flaw, which can lead to a denial‑of‑service condition for all users.

vLLM library version 0.17.0 and earlier are vulnerable. No specific vendor name is available through a CNA. The flaw is present in the multimodal/inputs.py module that handles audio and image retrieval.

The vulnerability can be exploited remotely by any user who can submit URLs to the media fetching functions. While no public exploit or proof of concept is cited, the lack of a size restriction makes the attack straightforward once the vulnerable endpoint is reachable. The CVSS score of 7.5 indicates moderate‑to‑high severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no current widespread exploitation. Nevertheless, the potential to consume server memory and cause a service halt warrants prompt mitigation.