What is GHSA-6vc9-vh4h-cxh4?

GHSA-6vc9-vh4h-cxh4 is a security advisory published by GitHub Security Advisories with High severity. vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API...

Which CVE IDs does GHSA-6vc9-vh4h-cxh4 cover?

GHSA-6vc9-vh4h-cxh4 covers the following CVE IDs: CVE-2026-116179. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6vc9-vh4h-cxh4?

GHSA-6vc9-vh4h-cxh4 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-6vc9-vh4h-cxh4HighCVSS 7.5

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API...

Vendor

GitHub Security Advisories

Published

October 25, 2026

Last Modified

October 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-116179 →

📋 Description

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so VideoMediaIO.load_base64 decodes every frame, exhausting memory and crashing the API frontend.

🔗 References (4)

https://github.com/vllm-project/vllm/security/advisories/GHSA-4m6g-h9mv-wqjc
https://nvd.nist.gov/vuln/detail/CVE-2026-116179
https://www.vulncheck.com/advisories/vllm-0.18.0-before-0.31.0-memory-exhaustion-via-media-io-kwargs-num-frames-override
https://github.com/advisories/GHSA-6vc9-vh4h-cxh4