CVE-2026-126399 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
vLLM, a server for running language models, lets inference clients bypass its frame limit by setting media_io_kwargs.video.num_frames in chat completion requests. An attacker can send num_frames=-1 or a large value with many base64 JPEG frames, forcing the server to decode and stack every frame until memory runs out.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run vLLM from 0.19.0 before 0.31.0 as an inference server that accepts video input in chat completion requests from clients they do not fully trust. Deployments that accept only text, or that sit behind trusted clients only, are less exposed. The sources do not say whether default configurations accept video.
Not affected if text-only-requests, trusted-clients-only
Who cares ai-inference, python, self-hosted, vllm
pip show vllm; affected versions are from 0.19.0 before 0.31.0.media_io_kwargs with video input.0.31.0 or later.vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the server frame limit by setting media_io_kwargs.video.num_frames in chat completion requests. Attackers can supply num_frames=-1 or a large value with many base64 JPEG frames, forcing VideoMediaIO to decode all frames and np.stack them, causing memory exhaustion.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.