REDHAT-BUG-2455403: High severity vllm vulnerability
vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19.0, the VideoMediaIO.loadbase64() method at vllm/multimodal/media/video.py splits video/jpeg data URLs by comma to extract individual JPEG frames, but does not enforce a frame count limit. The numframes parameter (default: 32), which is enforced by the loadbytes() code path, is completely bypassed in the video/jpeg base64 path. An attacker can send a single API request containing thousands of comma-separated base64-encoded JPEG frames, causing the server to decode all frames into memory and crash with OOM. This vulnerability is fixed in 0.19.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vllm/multimodal/media/video.py (VideoMediaIO.load_base64)to a version that resolves this vulnerability.Fixed in 0.19.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2455403?
The severity of REDHAT-BUG-2455403 is classified as high (7).
How do I fix REDHAT-BUG-2455403?
To fix REDHAT-BUG-2455403, update the vLLM software to version 0.19.0 or later, where the issue has been resolved.
What does REDHAT-BUG-2455403 affect?
REDHAT-BUG-2455403 affects the VideoMediaIO.load_base64() method in the vLLM library.
What kind of vulnerability is REDHAT-BUG-2455403?
REDHAT-BUG-2455403 is a vulnerability that allows the processing of video/jpeg data URLs without enforcing a frame count limit.
When was REDHAT-BUG-2455403 published?
REDHAT-BUG-2455403 was published on April 6, 2026.