CVE-2026-116179

{
  "etk_id": "ETK-2026-2604",
  "cve_id": "CVE-2026-116179",
  "display_id": "CVE-2026-116179",
  "ghsa_id": "GHSA-6vc9-vh4h-cxh4",
  "euvd_id": "EUVD-2026-109440",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Resource exhaustion in vLLM media frame processing",
  "summary": "vLLM versions 0.18.0 through 0.30.x can consume excessive memory while processing inline video or JPEG media. An API client may crash the frontend by bypassing the configured frame limit through media I/O request options. Exposure requires an API endpoint that accepts affected media inputs from the attacker.",
  "mitigation": "Upgrade vLLM to version 0.31.0 or later. Until upgraded, restrict untrusted access to media-processing API endpoints and limit or reject inline media requests where feasible.",
  "vendor": "vllm-project",
  "product": "vllm",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.18.0, < 0.31.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.31.0"
      ],
      "package_name": "vllm",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 38.91047328333333,
  "t0_at": "2026-10-25T13:20:18.520000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-25T13:20:18.520000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-25T13:20:18.520000+00:00",
      "url": "https://github.com/advisories/GHSA-6vc9-vh4h-cxh4"
    }
  }
}