CVE-2026-126399

EUVD-2026-125166
vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the server frame limit by setting media_io_kwargs.video.num_frames in chat completion requests. Attackers can supply num_frames=-1 or a large value with many base64 JPEG frames, forcing VideoMediaIO to decode all frames and np.stack them, causing memory exhaustion.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 41.68%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
vllmvllm
0.19.0 ≤
𝑥
< 0.31.0
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/vllm-project/vllm/security/advisories/GHSA-vxqj-p4gw-9h4c
https://www.vulncheck.com/advisories/vllm-0.19.0-before-0.31.0-resource-exhaustion-via-request-level-num-frames