vLLM: request-level num_frames bypasses frame limit and exhausts server memory

Impact

An inference client can override the server's video frame limit by setting media_io_kwargs.video.num_frames in a chat completion request. A value of -1 or a large number, sent with many base64 JPEG frames, makes vLLM decode and stack every frame until memory runs out. The serving process dies, and every tenant or application sharing that endpoint loses it, along with any in-flight batches on the GPU node.

Who can reach it

Any client that can send chat completion requests to a vLLM 0.19.0 through 0.30.x endpoint that accepts video input. The record scores it as needing low privileges (an authenticated API client). Where vLLM runs without --api-key, anyone who can reach the port qualifies.

What to do

Upgrade vLLM to 0.31.0 and restart the serving processes or pods. That reloads model weights, so roll it through replicas to keep capacity. Until then, limit the API to trusted clients and strip or reject media_io_kwargs at the gateway.

References

Related entries

• NVIDIA TensorRT-LLM: server-side request forgery lets a local user make the serving process issue arbitrary requestsCVE-2026-24269 · NVIDIA TensorRT-LLM (server-side request forgery in the serving component)High
• vLLM (`MediaConnector`): SSRF, recurrence of CVE-2025-6242CVE-2026-24779 · vLLM (`MediaConnector`)High
• vLLM (`load_from_url_async`): Bypass of the CVE-2026-24779 SSRF fixCVE-2026-25960 · vLLM (`load_from_url_async`)High
• LangSmith SDK: pulling a public Hub prompt deserializes attacker-controlled LangChain objectsCVE-2026-45134 · LangSmith SDK (pull_prompt / pullPrompt manifest deserialization)High
• picklescan: `scan_pytorch` bypass via forged magic numbersCVE-2026-53875 · picklescanHigh
• NVIDIA Megatron-LM: hash collisions in the inference cache let one request's data reach anotherCVE-2026-65104 · NVIDIA Megatron-LM (inference request cache)High