Vulnpedia
← Search CVEs

CVE-2026-105760

MEDIUM 5.3

Published 2026-10-05 · Last modified 2026-10-06

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options without a strict work ceiling. GLMGA constructs and deduplicates an attacker-sized pre-decode frame-index list, allowing a compact request and tiny valid video to consume disproportionate CPU time and memory in the shared media-loading executor. This issue is fixed in version 0.30.0.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 22nd percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

5.3CVSS 3.1 · MEDIUM

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityLow

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Vllm Project Vllm

Products Vllm

Weakness (CWE)

  • CWE-400: : Uncontrolled Resource Consumption

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • vllm PyPI

    pkg:pypi/vllm

    ECOSYSTEM range
    • Introduced version (included): 0.23.0rc2
    • Fixed boundary (excluded): 0.30.0
    9 explicitly listed affected versions

    0.23.0, 0.24.0, 0.25.0, 0.25.1, 0.26.0, 0.27.0, 0.27.1, 0.28.0, 0.29.0

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-58v5-2m8f-94pr/GHSA-58v5-2m8f-94pr.json"
  }
}
    GitHub Advisory Database · GHSA-58v5-2m8f-94pr · Updated 2026-10-15T14:56:16.469138285Z
  • vllm PyPI

    pkg:pypi/vllm

    ECOSYSTEM range
    • Introduced version (included): 0.23.0rc2
    • Fixed boundary (excluded): 0.30.0
    9 explicitly listed affected versions

    0.23.0, 0.24.0, 0.25.0, 0.25.1, 0.26.0, 0.27.0, 0.27.1, 0.28.0, 0.29.0

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/pypa/advisory-database/blob/main/vulns/vllm/PYSEC-2026-4307.yaml"
  }
}
    PyPA · PYSEC-2026-4307 · Updated 2026-10-15T14:45:14.672244043Z

Vendor product assessments

  • rhaii/vllm-cpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cpu-rhel9@sha256:81c5994dc20321f8bd3969099eade78ef127cbd79f2d0ccea101c773e4c7fa4d?repository_url=registry.redhat.io/rhaii/vllm-cpu-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhaii/vllm-cuda-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cuda-rhel9@sha256:0d22e2301ce26ef68effda5d3a4a20381ad0ea34d1240e159e245bd44c2e125b?repository_url=registry.redhat.io/rhaii/vllm-cuda-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhaii/vllm-gaudi-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-gaudi-rhel9@sha256:ce1e4fd82dd37d299ce8c64a237971d00faf602f06868c986e81aefa04c283ef?repository_url=registry.redhat.io/rhaii/vllm-gaudi-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhaii/vllm-neuron-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-neuron-rhel9@sha256:1079c9afecdbc33f4790792f0d712dbf7523790a92dcfbe8fb5cf4c2d282fc5b?repository_url=registry.redhat.io/rhaii/vllm-neuron-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhaii/vllm-rocm-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-rocm-rhel9@sha256:1a30359d6ca5d0891e403b9b0a23c0ae1ad6e30a2429b9b42e246b874fe8859a?repository_url=registry.redhat.io/rhaii/vllm-rocm-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhaii/vllm-spyre-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-spyre-rhel9@sha256:11ad6e13c41728944d933c7abe01d1d10ecb3f8e8b4f0da50ec53b7df6f036a8?repository_url=registry.redhat.io/rhaii/vllm-spyre-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhaii/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-tpu-rhel9@sha256:0c2ac747d67dc0e80162ff05867dd702e474b2217659f19f28b8e3a0c03a942a?repository_url=registry.redhat.io/rhaii/vllm-tpu-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhaiis/vllm-cpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cpu-rhel9@sha256:fb7791bbfea99e9f81529fe8cc1e7c834ca470585c27590e3d0a6834167cd436?repository_url=registry.redhat.io/rhaiis/vllm-cpu-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhaiis/vllm-cuda-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cuda-rhel9@sha256:73bbc4560132c4aaa9bbd608ce9560eeae7b30bcc8f014da460afa5622139372?repository_url=registry.redhat.io/rhaiis/vllm-cuda-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhaiis/vllm-neuron-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-neuron-rhel9@sha256:8ba72cec5d79b1a751eb09774c81fd6181b43ec69a2e5116982661b34366874d?repository_url=registry.redhat.io/rhaiis/vllm-neuron-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhaiis/vllm-rocm-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-rocm-rhel9@sha256:37b64a8df90756aae0ee96d2f07765adbce5ed5beb2414ac3845806ad2219cfc?repository_url=registry.redhat.io/rhaiis/vllm-rocm-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhaiis/vllm-spyre-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-spyre-rhel9@sha256:3dd7eff1c62cd4609b4c76590b77bb801cd064e40642ed32b5aa900a6bc643ea?repository_url=registry.redhat.io/rhaiis/vllm-spyre-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhaiis/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-tpu-rhel9@sha256:b1c12112a1e8a298645e10d34d44c9961a6121aa8d87fc5d65ad83e1ffa3c586?repository_url=registry.redhat.io/rhaiis/vllm-tpu-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhelai3/bootc-aws-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-aws-cuda-rhel9@sha256:a754d4d1126e98f203249414b3831182bb15ee6b3643452f167849defc642e4b?repository_url=registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhelai3/bootc-azure-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-azure-cuda-rhel9@sha256:df5b6edd1bdb055219a7385b6d5923f3262c3a408f92da734e3027af55fd593f?repository_url=registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhelai3/bootc-azure-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-azure-rocm-rhel9@sha256:8ea1233b1fb6b82d0aa69e9e4c47d2df242001280c11a61584066c27c5bec3a5?repository_url=registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-cuda-rhel9@sha256:b45f3bc25a7d3c9f3bfdc1de3be6db59f6c3109f62326d74fae14e832a797981?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhelai3/bootc-gaudi-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-gaudi-rhel9@sha256:e1057b59ca1be9501332abf97230855e85c7df858356be0da9dce230ea7e98e1?repository_url=registry.redhat.io/rhelai3/bootc-gaudi-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhelai3/bootc-gcp-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-gcp-cuda-rhel9@sha256:bac5d435d156c3ddcb581d3ff05fdce9f72bd617c5b8435cede16bb17b7bf12e?repository_url=registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhelai3/bootc-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-rocm-rhel9@sha256:38ce057f97034bbb8eaea574d41cc7eebaeaa9265a4cdd966476dd3fac129c3c?repository_url=registry.redhat.io/rhelai3/bootc-rocm-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhoai/odh-kserve-agent-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-agent-rhel9@sha256:cb2396d837f6249c85d55e118b61729e6c59cfb5a2bd45a0cf31867cb3f00cfc?repository_url=registry.redhat.io/rhoai/odh-kserve-agent-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhoai/odh-kserve-controller-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-controller-rhel9@sha256:344c4225761bc681101b7597088f7c23d43cac7ca09c24edb1f1c38e4b493059?repository_url=registry.redhat.io/rhoai/odh-kserve-controller-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhoai/odh-kserve-router-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-router-rhel9@sha256:03c98651276c00e36133c1926d90738940703cd12b2d47e5a3aa865e4c1872af?repository_url=registry.redhat.io/rhoai/odh-kserve-router-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhoai/odh-kserve-storage-initializer-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-storage-initializer-rhel9@sha256:48619d144fdf453a2ed670694d732ac71f7a3df00951dbdf62ee41a084f646cd?repository_url=registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhoai/odh-llm-d-kv-cache-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-llm-d-kv-cache-rhel9@sha256:cb5eedeefd2578cd9bd8637250bbe299c84539f57b4ead75d630ed9f833a6ef2?repository_url=registry.redhat.io/rhoai/odh-llm-d-kv-cache-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhoai/odh-th-torch-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-th-torch-cuda-py312-rhel9@sha256:efd7b3607b699092c68359d20ef0d0043114191a097637667c0d2cf78fbea702?repository_url=registry.redhat.io/rhoai/odh-th-torch-cuda-py312-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00
  • rhoai/odh-vllm-gaudi-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-vllm-gaudi-rhel9@sha256:87eec3862eb6ddef445f89dcf6fd89add7ef202ea7c563b1ee7347537fb3e250?repository_url=registry.redhat.io/rhoai/odh-vllm-gaudi-rhel9

    • workaround: Until a fixed package is available, exposure can be reduced at the deployment level: place an authenticating API gateway or reverse proxy in front of the vLLM OpenAI-compatible chat completions endpoint that removes or filters request-level media_io_kwargs video options (video_backend, fps, and max_frames) so untrusted callers cannot select the GLMGA video sampler or supply extreme sampling values, and apply rate limiting and request concurrency limits. Note that existing media byte, pixel, or decoded-frame limits do not necessarily bound the vulnerable pre-decode frame-index allocation. The upstream project fixed this issue in vLLM 0.30.0; for the affected Red Hat products the fix is currently deferred, so restricting endpoint access to trusted callers together with the gateway measures above is the available mitigation.
    • none available: Fix deferred
    Red Hat · CVE-2026-105760 · Updated 2026-10-15T23:33:35+00:00

Known Affected Software Configurations

VendorProductVersion range
VllmVllm≥ 0.23.0 and < 0.30.0

All CVSS metrics

  • MEDIUM 5.3 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  • MEDIUM 5.3 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS