CVE-2026-105760 vllm-project CVE debrief

Who should care

Defenders responsible for deploying and managing the vLLM library, particularly those exposing chat completions for video-capable models, should assess exposure and verify configurations. They should prioritize verifying the affected configurations, restricting access to the chat completions for video-capable models, and validating user input for `media_io_kwargs`. Additionally, defenders should monitor for unusual CPU and memory usage patterns and update

Why it matters

Defenders should care about this vulnerability as it allows for partial denial of service via request-driven CPU and memory exhaustion, impacting the availability of media services.

• Partial denial of service through CPU and memory exhaustion
• Potential delay in unrelated media requests
• Need for verification of affected configurations and user input validation

Technical summary

The vulnerability occurs in the shared media-loading executor before frame reads, allowing a tiny valid video and compact JSON options to consume disproportionate CPU time and memory and delay unrelated media requests. This happens when the OpenAI-compatible chat endpoint accepts request-level video loader options through `media_io_kwargs`, allowing a caller to select the GLMGA sampler and provide large `fps` and `max_frames` values. The demonstrated impact is partial denial of service. No memory corruption, data disclosure, or code execution is claimed.

Defensive priority

Defenders should prioritize verifying the affected configurations, restricting access to the chat completions for video-capable models, and validating user input for `media_io_kwargs`.

Recommended defensive actions

• Verify and restrict access to chat completions for video-capable models
• Validate and limit user input for `media_io_kwargs`
• Monitor for unusual CPU and memory usage patterns
• Update to version 0.30.0 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was demonstrated using an inline two-frame video and explicitly selecting the OpenCV decoder. The request is reachable without vLLM credentials when no API key is configured. The server must expose chat completions for a video-capable model and accept request-level `media_io_kwargs`. The model does not need to use GLMGA by default because the request value overrides the model's loader mapping.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.