PT-2026-123020
CVE-2026-116179
·
Published
2026-10-25
·
Updated
2026-10-25
Description by
CVSS 3.1
7.5
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num frames through media io kwargs. Attackers can set num frames to -1 with a large inline video so VideoMediaIO.load base64 decodes every frame, exhausting memory and crashing the API frontend.
Found an issue in the description? Have something to add? Feel free to write us 👾