CVE-2026-34755
MEDIUM EPSS 19.4%
Published Apr 6, 20262mo ago · Modified Jun 17, 20261w ago
6.5 CVSS 3.1
Published Apr 6, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago
Description
vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19.0, the VideoMediaIO.load_base64() method at vllm/multimodal/media/video.py splits video/jpeg data URLs by comma to extract individual JPEG frames, but does not enforce a frame count limit. The num_frames parameter (default: 32), which is enforced by the load_bytes() code path, is completely bypassed in the video/jpeg base64 path. An attacker can send a single API request containing thousands of comma-separated base64-encoded JPEG frames, causing the server to decode all frames into memory and crash with OOM. This vulnerability is fixed in 0.19.0.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
19.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-770
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| vllm | vllm | * | ≥0.7.0 – <0.19.0 |
References 1
- github.com https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p
Remediation
- github.com https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p