Vulnerability · Published Oct 25, 2026 · Assigned by VulnCheck
CVE-2026-116179vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override
High 7.5
In plain English
A high-severity resource allocation without limits in vllm from vllm-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 74.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so VideoMediaIO.load_base64 decodes every frame, exhausting memory and crashing the API frontend.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| vllm-project | vllm | 0.18.0 – before 0.31.0 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H