{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-34755", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T19:17:10.225Z", "datePublished": "2026-04-06T15:38:53.201Z", "dateUpdated": "2026-08-25T12:05:44.994Z" }, "containers": { "cna": { "title": "vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing", "problemTypes": [ { "descriptions": [ { "cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } } ], "references": [ { "name": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p", "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p" } ], "affected": [ { "vendor": "vllm-project", "product": "vllm", "versions": [ { "version": ">= 0.7.0, < 0.19.0", "status": "affected" } ] } ], "providerMetadata": { "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T15:38:53.201Z" }, "descriptions": [ { "lang": "en", "value": "vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19.0, the VideoMediaIO.load_base64() method at vllm/multimodal/media/video.py splits video/jpeg data URLs by comma to extract individual JPEG frames, but does not enforce a frame count limit. The num_frames parameter (default: 32), which is enforced by the load_bytes() code path, is completely bypassed in the video/jpeg base64 path. An attacker can send a single API request containing thousands of comma-separated base64-encoded JPEG frames, causing the server to decode all frames into memory and crash with OOM. This vulnerability is fixed in 0.19.0." } ], "source": { "advisory": "GHSA-pq5c-rjhq-qp7p", "discovery": "UNKNOWN" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-04-06T18:36:13.854345Z", "id": "CVE-2026-34755", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T18:36:31.152Z" } }, { "affected": [ { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3.2::el9" ], "defaultStatus": "affected", "packageName": "rhaiis/vllm-cuda-rhel9", "product": "Red Hat AI Inference Server 3.2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782951012", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3.2::el9" ], "defaultStatus": "affected", "packageName": "rhaiis/vllm-rocm-rhel9", "product": "Red Hat AI Inference Server 3.2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782951244", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhaii/vllm-cpu-rhel9", "product": "Red Hat AI Inference Server 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787151769", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhaii/vllm-spyre-rhel9", "product": "Red Hat AI Inference Server 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787151840", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhaii/vllm-cuda-rhel9", "product": "Red Hat AI Inference Server 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787151771", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhaii/vllm-rocm-rhel9", "product": "Red Hat AI Inference Server 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787151774", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhelai3/disk-image-cuda-rhel9", "product": "Red Hat Enterprise Linux AI 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787310717", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhelai3/bootc-aws-cuda-rhel9", "product": "Red Hat Enterprise Linux AI 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787253912", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhelai3/bootc-azure-cuda-rhel9", "product": "Red Hat Enterprise Linux AI 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787253989", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhelai3/bootc-azure-rocm-rhel9", "product": "Red Hat Enterprise Linux AI 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787254059", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhelai3/bootc-cuda-rhel9", "product": "Red Hat Enterprise Linux AI 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787243961", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhelai3/bootc-gcp-cuda-rhel9", "product": "Red Hat Enterprise Linux AI 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787253774", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhelai3/bootc-rocm-rhel9", "product": "Red Hat Enterprise Linux AI 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787244006", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3" ], "defaultStatus": "affected", "packageName": "rhaiis/vllm-neuron-rhel9", "product": "Red Hat AI Inference Server", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3" ], "defaultStatus": "affected", "packageName": "rhaiis/vllm-tpu-rhel9", "product": "Red Hat AI Inference Server", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-agent-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-controller-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-router-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-storage-initializer-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-vllm-cpu-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-vllm-cuda-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-vllm-gaudi-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-vllm-rocm-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" } ], "datePublic": "2026-04-06T15:38:53.201Z", "descriptions": [ { "lang": "en", "value": "A flaw was found in vLLM, an inference and serving engine for large language models. A remote attacker can exploit a vulnerability in the VideoMediaIO.load_base64() method by sending a single API request containing a large number of comma-separated base64-encoded JPEG frames. This bypasses the intended frame count limit, causing the server to decode all frames into memory. This can lead to an Out-of-Memory (OOM) crash, resulting in a Denial of Service (DoS) for the affected system." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE" } ] } ], "references": [ { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2026-34755" }, { "name": "RHBZ#2455403", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455403" }, { "tags": [ "x_sadp-csaf-vex" ], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34755.json" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:36005" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:36006" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:57380" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:57389" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:57390" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:57387" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:59151" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:59144" } ], "solutions": [ { "lang": "en", "value": "RHSA-2026:36005: Red Hat AI Inference Server 3.2" }, { "lang": "en", "value": "RHSA-2026:36006: Red Hat AI Inference Server 3.2" }, { "lang": "en", "value": "RHSA-2026:57380: Red Hat AI Inference Server 3.4" }, { "lang": "en", "value": "RHSA-2026:57389: Red Hat AI Inference Server 3.4" }, { "lang": "en", "value": "RHSA-2026:57390: Red Hat AI Inference Server 3.4" }, { "lang": "en", "value": "RHSA-2026:57387: Red Hat AI Inference Server 3.4" }, { "lang": "en", "value": "RHSA-2026:59151: Red Hat Enterprise Linux AI 3.4" }, { "lang": "en", "value": "RHSA-2026:59144: Red Hat Enterprise Linux AI 3.4" } ], "timeline": [ { "lang": "en", "time": "2026-04-06T16:02:21.718Z", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2026-04-06T15:38:53.201Z", "value": "Made public." } ], "title": "vLLM: vLLM: Denial of Service due to excessive video frame processing", "workarounds": [ { "lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability." } ], "x_adpType": "supplier", "x_generator": { "engine": "sadp-cli 1.0.0" }, "providerMetadata": { "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-25T12:05:44.994Z" } } ] } }