CVE-2026-116179

The vLLM library, versions 0.18.0 before 0.31.0 , is susceptible to a memory exhaustion vulnerability. An attacker can bypass the video/jpeg frame-count cap by overriding the num_frames parameter through media_io_kwargs. By setting num_frames to -1 while providing a large inline video, the VideoM...

CVE-2026-116179 vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding numframes through mediaiokwargs. Attackers can set numframes to -1 with a large inline video so VideoMediaIO.loadbase64 decodes every frame,...

EUVD-2026-109440

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding numframes through mediaiokwargs. Attackers can set numframes to -1 with a large inline video so VideoMediaIO.loadbase64 decodes every frame,...