{"id":"CVE-2026-116179","kind":"vulnerability","aliases":["CVE-2026-116179"],"related":[],"title":"vLLM: API clients can bypass frame cap and exhaust memory","description":"vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so VideoMediaIO.load_base64 decodes every frame, exhausting memory and crashing the API frontend.","summary":"vLLM versions from 0.18.0 before 0.31.0 let API clients override the video frame-count limit through media_io_kwargs. Setting num_frames to -1 with a large inline video makes the server decode every frame, which exhausts memory and crashes the API frontend.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","llm-serving","self-hosted","vllm"],"not_affected_if":["auth-required","text-only-models","trusted-clients-only"],"how_to_check":"- Check the installed version with `pip show vllm` or `python -c \"import vllm; print(vllm.__version__)\"`; versions from `0.18.0` up to but not including `0.31.0` are affected.\n- Check whether the OpenAI-compatible API accepts video input with inline base64 data from untrusted clients.","fix":"- Upgrade vLLM to `0.31.0` or later.\n- Until upgraded, restrict API access to trusted clients or reject requests that set media_io_kwargs for video.","status":"open","published_at":"2026-10-25T14:16:57+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:17+00:00","updated_at":"2026-10-25T14:42:17+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T14:42:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vLLM to `0.31.0` or later.\n- Until upgraded, restrict API access to trusted clients or reject requests that set media_io_kwargs for video.","reach":"network","title":"vLLM: API clients can bypass frame cap and exhaust memory","impact":"medium","summary":"vLLM versions from 0.18.0 before 0.31.0 let API clients override the video frame-count limit through media_io_kwargs. Setting num_frames to -1 with a large inline video makes the server decode every frame, which exhausts memory and crashes the API frontend.","category":"ai-tooling","nicknames":[],"who_cares":["vllm","self-hosted","llm-serving"],"confidence":0.7,"needs_auth":"unknown","worst_case":"API frontend crashes from memory exhaustion, causing denial of service","analyst_note":"Confirm the exact fixed version and whether unauthenticated API access is the default, using the NVD entry and the vLLM GitHub advisory.","how_to_check":"- Check the installed version with `pip show vllm` or `python -c \"import vllm; print(vllm.__version__)\"`; versions from `0.18.0` up to but not including `0.31.0` are affected.\n- Check whether the OpenAI-compatible API accepts video input with inline base64 data from untrusted clients.","needs_analyst":true,"not_affected_if":["text-only-models","auth-required","trusted-clients-only"],"who_is_affected":"Teams running a vLLM server that accepts video inputs from API clients, especially if that endpoint is reachable by users outside the team. Deployments that only serve text, or that sit behind trusted internal callers only, are at much lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":3360,"output_tokens":621,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':51B,107C '-116179':13A,16A '-2026':12A,15A '0.18.0':30B,73C '0.31.0':32B,75C 'ai':18B 'ai-tool':17B 'allow':82C 'api':2A,34B,69B,83C,124C 'attack':101C 'base64':115C 'bypass':5A,86C 'cap':7A,92C 'client':3A,35B,84C 'contain':76C 'count':41B,91C 'crash':67B,122C 'cve':11A,14A 'decod':60B,116C 'everi':61B,117C 'exhaust':9A,64B,79C,119C 'frame':6A,40B,49B,62B,90C,96C,105C,118C 'frame-count':39B,89C 'frontend':70B,125C 'host':25B 'inlin':55B,111C 'io':45B,99C 'kwarg':46B,100C 'larg':54B,110C 'let':33B 'limit':42B 'llm':21B 'llm-serv':20B 'make':57B 'media':44B,98C 'memori':10A,65B,120C 'num':48B,95C,104C 'overrid':36B,94C 'resourc':78C 'self':24B 'self-host':23B 'serv':22B 'server':59B 'set':47B,103C 'tool':19B 'version':28B 'video':38B,56B,112C 'video/jpeg':88C 'videomediaio.load':114C 'vllm':1A,26B,27B,71C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Teams running a vLLM server that accepts video inputs from API clients, especially if that endpoint is reachable by users outside the team. Deployments that only serve text, or that sit behind trusted internal callers only, are at much lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116179","severity":null,"published_at":"2026-10-25T14:16:57+00:00","modified_at":"2026-10-25T14:16:57+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}