vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so VideoMediaIO.load_base64 decodes every frame, exhausting memory and crashing the API frontend.
| CVE | CVE-2026-116179 |
|---|---|
| Severidad | HIGH |
| CVSS | 7.5 / 10 |
| CWE | CWE-770 |
| Exposición (Shodan) | sin hosts expuestos detectados actualmente |
Producto afectado
vLLM from 0.18.0 – 0.31.0
Producto derivado de la descripción (el CPE estructurado de NVD aún no está publicado).