CVE-2026-116179: vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override

Q: Who can exploit this issue?

Any API client that can submit requests containing inline video or JPEG media is a potential attacker. The issue requires no authentication or user interaction according to the supplied vector.

Q: What request behavior triggers the memory exhaustion?

An attacker sets media_io_kwargs.num_frames to -1 and supplies a large inline video. This causes VideoMediaIO.load_base64 to decode every frame rather than enforcing the frame-count cap, which can exhaust memory and crash the API frontend.

Q: Which vLLM versions are affected?

vLLM versions from 0.18.0 up to, but not including, 0.31.0 are affected. Upgrading to 0.31.0 or later removes the affected version range.

Published Oct 25, 2026

Updated

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding numframes through mediaiokwargs. Attackers can set numframes to -1 with a large inline video so VideoMediaIO.loadbase64 decodes every frame, exhausting memory and crashing the API frontend.

Affected Software

1 affected component

pypi/vllm>=0.18.0<0.31.0

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any API client that can submit requests containing inline video or JPEG media is a potential attacker. The issue requires no authentication or user interaction according to the supplied vector.

What request behavior triggers the memory exhaustion?

An attacker sets media_io_kwargs.num_frames to -1 and supplies a large inline video. This causes VideoMediaIO.load_base64 to decode every frame rather than enforcing the frame-count cap, which can exhaust memory and crash the API frontend.

Which vLLM versions are affected?

vLLM versions from 0.18.0 up to, but not including, 0.31.0 are affected. Upgrading to 0.31.0 or later removes the affected version range.

CVE-2026-116179: vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What request behavior triggers the memory exhaustion?

Which vLLM versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What request behavior triggers the memory exhaustion?

Which vLLM versions are affected?