{"id":"CVE-2026-126399","kind":"vulnerability","aliases":["CVE-2026-126399"],"related":[],"title":"vLLM: crafted video requests exhaust server memory during frame decoding","description":"vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the server frame limit by setting media_io_kwargs.video.num_frames in chat completion requests. Attackers can supply num_frames=-1 or a large value with many base64 JPEG frames, forcing VideoMediaIO to decode all frames and np.stack them, causing memory exhaustion.","summary":"vLLM, a server for running language models, lets inference clients bypass its frame limit by setting media_io_kwargs.video.num_frames in chat completion requests. An attacker can send num_frames=-1 or a large value with many base64 JPEG frames, forcing the server to decode and stack every frame until memory runs out.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-inference","ai-tooling","python","self-hosted","vllm"],"not_affected_if":["text-only-requests","trusted-clients-only"],"how_to_check":"- Check the installed vLLM version with `pip show vllm`; affected versions are from `0.19.0` before `0.31.0`.\n- Look for chat completion requests that accept client-supplied `media_io_kwargs` with video input.","fix":"- Move vLLM to `0.31.0` or later.","status":"open","published_at":"2026-11-13T10:17:44+00:00","first_seen_at":"2026-11-13T10:47:19+00:00","triaged_at":"2026-11-13T10:53:15+00:00","updated_at":"2026-11-13T10:53:15+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-13T10:53:15Z","model":"claude-haiku-5-5","output":{"fix":"- Move vLLM to `0.31.0` or later.","reach":"network","title":"vLLM: crafted video requests exhaust server memory during frame decoding","impact":"medium","summary":"vLLM, a server for running language models, lets inference clients bypass its frame limit by setting media_io_kwargs.video.num_frames in chat completion requests. An attacker can send num_frames=-1 or a large value with many base64 JPEG frames, forcing the server to decode and stack every frame until memory runs out.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["vllm","python","self-hosted","ai-inference"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Server process runs out of memory and stops serving requests","analyst_note":"Confirm whether default vLLM configs accept video input and whether authentication is required, using the maintainer's advisory linked from the NVD entry.","how_to_check":"- Check the installed vLLM version with `pip show vllm`; affected versions are from `0.19.0` before `0.31.0`.\n- Look for chat completion requests that accept client-supplied `media_io_kwargs` with video input.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["text-only-requests","trusted-clients-only"],"who_is_affected":"Teams that run vLLM from 0.19.0 before 0.31.0 as an inference server that accepts video input in chat completion requests from clients they do not fully trust. Deployments that accept only text, or that sit behind trusted clients only, are less exposed. The sources do not say whether default configurations accept video.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000774,"input_tokens":4646,"output_tokens":618,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':56B,111C '-126399':13A,16A '-2026':12A,15A '0.19.0':80C '0.31.0':82C 'ai':18B,21B 'ai-infer':17B 'ai-tool':20B 'allow':89C 'attack':51B,106C 'base64':63B,118C 'bypass':38B,93C 'caus':130C 'chat':47B,103C 'client':37B,91C 'complet':48B,104C 'contain':83C 'craft':2A 'cve':11A,14A 'decod':10A,70B,124C 'everi':73B 'exhaust':5A,86C,132C 'forc':66B,121C 'frame':9A,40B,45B,55B,65B,74B,96C,101C,110C,120C,126C 'host':26B 'infer':19B,36B,90C 'jpeg':64B,119C 'languag':33B 'larg':59B,114C 'let':35B 'limit':41B,97C 'mani':62B,117C 'media_io_kwargs.video.num':44B,100C 'memori':7A,76B,131C 'model':34B 'np.stack':128C 'num':54B,109C 'python':23B 'request':4A,49B,105C 'resourc':85C 'run':32B,77B 'self':25B 'self-host':24B 'send':53B 'server':6A,30B,68B,95C 'set':43B,99C 'stack':72B 'suppli':108C 'tool':22B 'valu':60B,115C 'video':3A 'videomediaio':122C 'vllm':1A,27B,28B,78C 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"Teams that run vLLM from 0.19.0 before 0.31.0 as an inference server that accepts video input in chat completion requests from clients they do not fully trust. Deployments that accept only text, or that sit behind trusted clients only, are less exposed. The sources do not say whether default configurations accept video.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiinference","aitooling","high","python","selfhosted","vllm"],"campaign_type":null,"search_a":"'-126399':13A,16A '-2026':12A,15A 'craft':2A 'cve':11A,14A 'decod':10A 'exhaust':5A 'frame':9A 'memori':7A 'request':4A 'server':6A 'video':3A 'vllm':1A","search_b":"'-1':56B 'ai':18B,21B 'ai-infer':17B 'ai-tool':20B 'attack':51B 'base64':63B 'bypass':38B 'chat':47B 'client':37B 'complet':48B 'decod':70B 'everi':73B 'forc':66B 'frame':40B,45B,55B,65B,74B 'host':26B 'infer':19B,36B 'jpeg':64B 'languag':33B 'larg':59B 'let':35B 'limit':41B 'mani':62B 'media_io_kwargs.video.num':44B 'memori':76B 'model':34B 'num':54B 'python':23B 'request':49B 'run':32B,77B 'self':25B 'self-host':24B 'send':53B 'server':30B,68B 'set':43B 'stack':72B 'tool':22B 'valu':60B 'vllm':27B,28B","search_c":"'-1':111C '0.19.0':80C '0.31.0':82C 'allow':89C 'attack':106C 'base64':118C 'bypass':93C 'caus':130C 'chat':103C 'client':91C 'complet':104C 'contain':83C 'decod':124C 'exhaust':86C,132C 'forc':121C 'frame':96C,101C,110C,120C,126C 'infer':90C 'jpeg':119C 'larg':114C 'limit':97C 'mani':117C 'media_io_kwargs.video.num':100C 'memori':131C 'np.stack':128C 'num':109C 'request':105C 'resourc':85C 'server':95C 'set':99C 'suppli':108C 'valu':115C 'videomediaio':122C 'vllm':78C 'vulner':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T22:22:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126399","severity":null,"published_at":"2026-11-13T10:17:44+00:00","modified_at":"2026-11-13T10:17:44+00:00","first_seen_at":"2026-11-13T10:47:19+00:00","fetched_at":"2026-11-13T10:47:19+00:00","note":null}],"documents":[{"id":110584,"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-vxqj-p4gw-9h4c","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-10-27T22:22:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145042,"url":"https://www.vulncheck.com/advisories/vllm-0.19.0-before-0.31.0-resource-exhaustion-via-request-level-num-frames","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}