CVE-2026-105760

Received Received - Intake

Resource Exhaustion in vLLM via GLMGA Video Backend

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options without a strict work ceiling. GLMGA constructs and deduplicates an attacker-sized pre-decode frame-index list, allowing a compact request and tiny valid video to consume disproportionate CPU time and memory in the shared media-loading executor. This issue is fixed in version 0.30.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-05

Generated

2026-10-06

AI Q&A

2026-10-06

EPSS Evaluated

N/A

NVD

CVE-2026-105760

Affected Vendors & Products

Vendor	Product	Version / Range
vllm-project	vllm	>= 0.23.0rc2, < 0.30.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in vLLM before version 0.30.0 allows an attacker to send a specially crafted request with large values for fps and max_frames parameters using the GLMGA video backend. The system then creates an excessively large frame-index list during processing, consuming disproportionate CPU and memory resources in the shared media-loading executor.

Detection Guidance

This vulnerability can be detected by checking the version of vLLM installed on your system. If the version is below 0.30.0, the system is vulnerable. Run the command: vllm --version to check the installed version.

Impact Analysis

This could lead to denial-of-service conditions where the system becomes unresponsive or crashes due to excessive resource consumption. It may also cause performance degradation for other legitimate users sharing the same media-loading executor.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service conditions through excessive CPU and memory consumption. Uncontrolled resource usage may lead to service disruptions, affecting data processing integrity and availability, which are critical under these regulations.

Mitigation Strategies

Upgrade vLLM to version 0.30.0 or later to address the vulnerability. Monitor resource usage on systems running vLLM, especially those handling video processing requests.

Hi! I’m here to help you understand CVE-2026-105760. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70