CVE-2026-126394

The vLLM library (versions 0.30.0 before 0.31.0 ) contains a resource exhaustion vulnerability in the OpenCVDynamicOpenPanguVideoBackend . The issue stems from the component using request-controlled num_frames without an effective ceiling. Unauthenticated attackers can trigger a denial of service...

EUVD-2026-125171

vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vulnerability in OpenCVDynamicOpenPanguVideoBackend, which uses request-controlled numframes without an effective ceiling. Unauthenticated attackers can send /v1/chat/completions or /tokenize requests selecting the openpangu videobackend wi...

CVE-2026-126399

The vLLM framework versions 0.19.0 before 0.31.0 is susceptible to a resource exhaustion vulnerability. An inference client can bypass server frame limits by manipulating the media_io_kwargs.video.num_frames parameter in chat completion requests. By providing a large value or -1 alongside multipl...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via VideoMediaIO.loadbase64 in the multimodal media handling path, where request-level...

CVE-2026-116179

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding numframes through mediaiokwargs. Attackers can set numframes to -1 with a large inline video so VideoMediaIO.loadbase64 decodes every frame,...

CVE-2026-116179 vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding numframes through mediaiokwargs. Attackers can set numframes to -1 with a large inline video so VideoMediaIO.loadbase64 decodes every frame,...

CVE-2026-116179 vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding numframes through mediaiokwargs. Attackers can set numframes to -1 with a large inline video so VideoMediaIO.loadbase64 decodes every frame,...

CVE-2026-116179 vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding numframes through mediaiokwargs. Attackers can set numframes to -1 with a large inline video so VideoMediaIO.loadbase64 decodes every frame,...

EUVD-2026-109440

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding numframes through mediaiokwargs. Attackers can set numframes to -1 with a large inline video so VideoMediaIO.loadbase64 decodes every frame,...

CVE-2026-116179

The vLLM library, versions 0.18.0 before 0.31.0 , is susceptible to a memory exhaustion vulnerability. An attacker can bypass the video/jpeg frame-count cap by overriding the num_frames parameter through media_io_kwargs. By setting num_frames to -1 while providing a large inline video, the VideoM...

CVE-2023-25667: Integer Overflow or Wraparound

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, integer overflow occurs when 2^31 = numframes height width channels 2^32, for example Full HD screencast of at least 346 frames. A fix is included in TensorFlow version 2.12.0 and version 2.11.1...