CVE-2026-34755
JPEG video loading could exceed the server’s frame budget
vLLM · Video frame decoding
First documented disclosure · Review checkpoint
Summary
The JPEG video loader decoded the full frame list before enforcing the configured cap. Processing oversized frame lists could exhaust memory and interrupt service.
Severity and exploitation evidence
Medium · 6.5/10 · CVSS 3.1. Severity source.
Exploitation not established: The reviewed sources describe the weakness and correction. They identify no confirmed malicious use.
Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.
How the weakness works
The JPEG video loader decoded the full frame list before enforcing the configured cap.
Conditions required
A client can submit the affected video format to a reachable inference service.
Potential impact
Processing oversized frame lists could exhaust memory and interrupt service.
Affected versions and configurations
0.7.0 through releases before 0.19.0.
Fix and mitigation status
0.19.0 for this issue.
Practical next steps
Use a supported vLLM release containing the 0.19.0 fix. The later request-override correction is included in 0.31.0.
Operating lesson
Budget memory before decoding untrusted media.
Evidence and limits
A later advisory documents a separate override of this limit. Use a supported release that includes the later correction in 0.31.0. The issuing CNA published the CVE record on 2026-04-06.
Sources
- vLLM project security advisory
Primary source ·
- Public vLLM project change
Primary source ·
- Issuing CNA record and severity assessment
Primary source ·