CVE-2026-105760: CWE-400: Uncontrolled Resource Consumption in vllm-project vllm
Description
CVE-2026-105760 is an uncontrolled resource consumption vulnerability in vllm, an inference and serving engine for large language models. Versions from 0.23.0rc2 up to but not including 0.30.0 allow attackers to exploit the media_io_kwargs field to select the GLMGA video backend and supply large fps and max_frames values. This causes excessive CPU and memory usage due to the construction of a large pre-decode frame-index list. The issue is fixed in version 0.30.0.
CVSS v3.1
Score 5.3medium
Affected software
vllm-project
vllm
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In vllm versions >=0.23.0rc2 and <0.30.0, the media_io_kwargs field can be manipulated to select the GLMGA video backend with large fps and max_frames parameters without a strict upper limit. This leads to the creation and deduplication of an attacker-sized pre-decode frame-index list, resulting in disproportionate CPU and memory consumption in the shared media-loading executor. This uncontrolled resource consumption vulnerability (CWE-400) can degrade availability. The vulnerability is resolved in vllm version 0.30.0.
Potential Impact
An attacker can cause excessive CPU and memory consumption on systems running affected versions of vllm by sending specially crafted requests. This can lead to denial of service conditions due to resource exhaustion. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Upgrade to vllm version 0.30.0 or later, where this vulnerability is fixed. No other mitigation is indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-05T19:11:07.948Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac430632cdf04f65645c896
Added to database: 10/05/2026, 23:18:59 UTC
Last enriched: 10/05/2026, 23:33:15 UTC
Last updated: 10/05/2026, 23:33:54 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.