What happened
vLLM's nemotron_vl.py and nano_nemotron_vl.py each set Image.MAX_IMAGE_PIXELS = None at module load time, permanently disabling Pillow's process-global decompression-bomb defense. An unauthenticated caller who can reach /v1/chat/completions on an instance that has imported either Nemotron-VL processor can submit a pathological image that decompresses into substantial memory, potentially OOM-killing the worker.
Why it matters
Because the setting is process-global, the guard is disabled for every image load in that process, and the attack is unauthenticated and single-request. It lets a remote caller exhaust memory and deny service to co-tenants on a shared vLLM serving instance (CWE-400, CVSS 7.5).
Attack vector
Send a crafted decompression-bomb image to /v1/chat/completions to exhaust memory and OOM-kill the worker.
Affected systems
vLLM >= 0.10.2, < 0.25.0 deploying Nemotron-VL models.
Mitigation
Upgrade to vLLM 0.25.0 (PR #47010 removes the module-level assignments and adds a configurable VLLM_MAX_IMAGE_PIXELS decoded-pixel-count limit).