iHore/vLLM
8
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

[Security] Gate per-request multimodal processor kwargs (#58830)

Browse Source 
Signed-off-by: Juan Pérez de Algaba <jperezde@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Juan Pérez de Algaba
2026-09-26 11:10:35 +00:00
committed by GitHub
co-authored by Cursor
parent 2f41e00235
commit 31f2e70cd3
17 changed files with 203 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/usage/security.md
+13
View File
@@ -289,6 +289,19 @@ To mitigate this, vLLM enforces a configurable upper bound on the `n` parameter
- **Reverse proxy layer:** In addition to vLLM's built-in limit, consider enforcing request body validation and rate limiting at your reverse proxy to further constrain abusive payloads.
- **Monitoring:** Monitor per-request resource consumption to detect anomalous patterns that may indicate abuse.
### Per-request multimodal arguments
API server endpoints reject non-empty per-request `mm_processor_kwargs` and
`media_io_kwargs` by default. These arguments can change image, video, or audio
loading, sizing, sampling, and preprocessing behavior, causing excessive CPU,
GPU, or memory use when controlled by an untrusted client. Server-level
`--mm-processor-kwargs` and `--media-io-kwargs` remain available for deployment
configuration.
Only deployments whose API clients are trusted should start the server with
`--trust-request-mm-kwargs` to restore per-request overrides. Do not enable
this option on an endpoint exposed to untrusted clients.
## Tool Server and MCP Security
vLLM supports connecting to external tool servers via the `--tool-server` argument. This enables models to call tools through the Responses API (`/v1/responses`). Tool server support works with all models — it is not limited to specific model architectures.