CVE-2026-105758

Katalog CVE

CVSS 5.3 · Medium EPSS 0,30%

Kerentanan Allocation of Resources Without Limits or Throttling pada vllm. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs.video.fps fields without enforcing server-side ceilings. An unauthenticated caller can submit these values to the /tokenize endpoint, causing the sampler to decode every frame selected from attacker-controlled video input, consume disproportionate frontend memory, and potentially terminate the API process before scheduling or admission control. The Rust frontend is not affected because it rejects the media_io_kwargs field. This issue is fixed in version 0.30.0.

Rincian

Terbit di NVD

5 Oktober 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 21,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vllm-project/vllm/security/advisories/GHSA-x6mc-67gf-chw4 mitigasi · advisory vendor
• https://github.com/vllm-project/vllm/commit/ea723c81c3ea26425cb69503a5d5e90822a04a45 patch
• https://github.com/vllm-project/vllm/pull/56729 issue tracking · patch
• https://github.com/vllm-project/vllm/releases/tag/v0.30.0 release notes