Request an audit

// CVE · Published · CVE.org

CVE-2026-1057585.3 · Medium · CVSS 3.1

vLLM Qwen2-VL / Qwen3-VL video sampler memory exhaustion.

The Qwen2-VL and Qwen3-VL video samplers bound on the request-controlled max_frames value, which the server-side frame ceiling does not reach. One unauthenticated request to /tokenize exhausts API-server memory before admission control.

Published
Vendor
vLLM
Product
vLLM (Qwen2-VL / Qwen3-VL video backends)
Affected
>= 0.24.0, < 0.30.0
Fixed in
0.30.0 (PR #56729)
Research area
AI Infrastructure
Credit
Eva Crystal (0xiviel), XSource Security
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

vLLM’s Qwen2-VL and Qwen3-VL video backends took the request-level media_io_kwargs.video.max_frames and fps values as the bound for frame sampling. The server-side num_frames ceiling did not reach that path, so the request decided how many frames of an attacker-supplied video were decoded.

Impact

An unauthenticated caller can send one request to /tokenize that makes the sampler decode every selected frame, consuming API-server memory before scheduling or admission control and potentially terminating the API process. The Rust frontend is not affected because it rejects the media_io_kwargs field. Rated CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3, Medium), CWE-770.

Affected and fixed

  • Affected: vLLM 0.24.0 up to, but not including, 0.30.0
  • Fixed: vLLM 0.30.0, PR #56729

Timeline

  • Sep 2026: reported as a private GitHub security advisory
  • 23 Sep 2026: advisory published by the maintainers as GHSA-x6mc-67gf-chw4
  • 5 Oct 2026: CVE-2026-105758 issued by GitHub and published on the CVE List

Credit

Reported by 0xiviel / Eva Crystal (XSource Security).

More disclosures

All disclosures →