Description
vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so VideoMediaIO.load_base64 decodes every frame, exhausting memory and crashing the API frontend.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vllm-project | vllm | 0.18.0 – < 0.31.0 | 0.31.0 |
Advisories 1
- WID-SEC-2026-3828 vllm: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
References
- GitHub Security Advisory (GHSA-4m6g-h9mv-wqjc) vendor-advisory
- VulnCheck Advisory: vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override third-party-advisory