CVE-2026-105758: vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach
An unauthenticated remote attacker can exhaust the memory of the vLLM API-server process by raising the request-level media_io_kwargs.video.max_frames and fps knobs on any deployment serving a Qwen2-VL or Qwen3-VL model. 74 extra bytes of JSON took the server’s peak RSS from 2 271 MiB to 13 629 MiB over unauthenticated POST /tokenize.
The num_frames ceiling reported in GHSA-vxqj-p4gw-9h4c and fixed by open PR #51969 does not reach this path: the Qwen samplers do not read num_frames at all. The same knobs were already capped upstream for GLMGAVideoBackend as an accepted security fix in 8b6de0eb9 (PR #54935, merged 2026-09-04); that cap never reached Qwen.
References
- github.com/advisories/GHSA-x6mc-67gf-chw4
- github.com/vllm-project/vllm/commit/ea723c81c3ea26425cb69503a5d5e90822a04a45
- github.com/vllm-project/vllm/pull/56729
- github.com/vllm-project/vllm/releases/tag/v0.30.0
- github.com/vllm-project/vllm/security/advisories/GHSA-x6mc-67gf-chw4
- nvd.nist.gov/vuln/detail/CVE-2026-105758
Code Behaviors & Features
Detect and mitigate CVE-2026-105758 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →