CVE-2026-116179

Name of the Vulnerable Software and Affected Versions vLLM versions 0.18.0 through 0.30.0

Description A resource exhaustion issue allows API clients to bypass the video/jpeg frame-count limit. By overriding the num frames variable through media io kwargs, an attacker can set num frames to -1 while providing a large inline video. This causes the VideoMediaIO.load base64() function to decode every frame, leading to memory exhaustion and a crash of the API frontend.

Recommendations Update vLLM to version 0.31.0 or later.