What happened
In vLLM from 0.10.1 to before 0.31.0, the OpenAI-compatible Python front-end forwards a request-controlled mm_processor_kwargs.max_patches value to the Hugging Face processor for Cohere2 Vision models without a server-side upper bound. Because the preprocessing work grows quadratically with the value and clients can vary it to bypass the small LRU cache, a remote client can send small image chat-completion requests that exhaust preprocessing workers and deny service to other clients.
Why it matters
This is an unauthenticated remote resource-exhaustion vector against a widely deployed model-serving engine (the default vLLM server does not require an API key), allowing a practical denial of service on deployments serving Cohere2 Vision. It typifies the AI-serving pitfall of trusting request-controlled computational budgets without server-side limits.
Attack vector
Remote unauthenticated image chat-completion request with a large, varying mm_processor_kwargs.max_patches value, triggering quadratic preprocessing work that starves workers.
Affected systems
vLLM 0.10.1 – 0.30.x (Cohere2 Vision multimodal preprocessing path)
Mitigation
Upgrade to vLLM 0.31.0+; add API auth and rate/parameter limits if you serve Cohere2 Vision models; log and review anomalous image requests with large max_patches values.