Skip to content
Heist/ feed
Back to feed
MediumFix available

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

Type: advisorySources: OSV2 source records

## Summary The OpenAI-compatible chat endpoint accepts request-level video loader options through `media_io_kwargs`. A caller can select the GLMGA sampler and provide large `fps` and `max_frames` values. GLMGA first constructs an attacker-sized Python index list and then deduplicates it, even when the supplied video contains only a few frames. This work occurs in the shared media-loading executor before frame reads, allowing a tiny valid video and compact JSON options to consume disproportionate CPU time and memory and delay unrelated media requests. The demonstrated impact is partial denial of service. No memory corruption, data disclosure, or code execution is claimed. ## Affected configuration The server must expose chat completions for a video-capable model and accept request-level `media_io_kwargs`. The model does not need to use GLMGA by default because the request value overrides the model's loader mapping. The proof of concept uses an inline two-frame video and explicitly selects the OpenCV decoder, so no external media host or GPU decoder is required. The request is reachable without vLLM credentials when no API key is configured. With API-key authentication enabled, any caller holding a valid key can reach the same path. ## Attack surface A remote caller submits a valid chat-completion request with a small video and the following request-level options: ```json { "media_io_kwargs": { "video": { "video_backend": "glmga", "backend": "opencv", "fps": 500000, "max_frames

Products
vllm
Affected versions
0.23.0, 0.24.0, 0.25.0, 0.25.1, 0.26.0, 0.27.0, 0.27.1, 0.28.0, 0.29.0
Fixed versions
0.30.0
CVEs
CVE-2026-105760
Confirmed fixed CVEs
Not specified
Updated in this feed
30 Oct 2026, 18:17 UTC · Revision 1

Source evidence

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

core-osv · Original source

Published 5 Oct 2026, 23:42 UTC

## Summary The OpenAI-compatible chat endpoint accepts request-level video loader options through `media_io_kwargs`. A caller can select the GLMGA sampler and provide large `fps` and `max_frames` values. GLMGA first constructs an attacker-sized Python index list and then deduplicates it, even when the supplied video contains only a few frames. This work occurs in the shared media-loading executor before frame reads, allowing a tiny valid video and compact JSON options to consume disproportionate CPU time and memory and delay unrelated media requests. The demonstrated impact is partial denial of service. No memory corruption, data disclosure, or code execution is claimed. ## Affected configuration The server must expose chat completions for a video-capable model and accept request-level `media_io_kwargs`. The model does not need to use GLMGA by default because the request value overrides the model's loader mapping. The proof of concept uses an inline two-frame video and explicitly selects the OpenCV decoder, so no external media host or GPU decoder is required. The request is reachable without vLLM credentials when no API key is configured. With API-key authentication enabled, any caller holding a valid key can reach the same path. ## Attack surface A remote caller submits a valid chat-completion request with a small video and the following request-level options: ```json { "media_io_kwargs": { "video": { "video_backend": "glmga", "backend": "opencv", "fps": 500000, "max_frames

osv:GHSA-58v5-2m8f-94pr

vllm

Fixed versions: 0.30.0

Complete source record
{
  "id": "ee60ec58e2d5206c304e3a09cb3684cbc6ed613073e677d0f3f7d800a2e397f9",
  "url": "https://osv.dev/vulnerability/GHSA-58v5-2m8f-94pr",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion",
    "summary": "## Summary The OpenAI-compatible chat endpoint accepts request-level video loader options through `media_io_kwargs`. A caller can select the GLMGA sampler and provide large `fps` and `max_frames` values. GLMGA first constructs an attacker-sized Python index list and then deduplicates it, even when the supplied video contains only a few frames. This work occurs in the shared media-loading executor before frame reads, allowing a tiny valid video and compact JSON options to consume disproportionate CPU time and memory and delay unrelated media requests. The demonstrated impact is partial denial of service. No memory corruption, data disclosure, or code execution is claimed. ## Affected configuration The server must expose chat completions for a video-capable model and accept request-level `media_io_kwargs`. The model does not need to use GLMGA by default because the request value overrides the model's loader mapping. The proof of concept uses an inline two-frame video and explicitly selects the OpenCV decoder, so no external media host or GPU decoder is required. The request is reachable without vLLM credentials when no API key is configured. With API-key authentication enabled, any caller holding a valid key can reach the same path. ## Attack surface A remote caller submits a valid chat-completion request with a small video and the following request-level options: ```json { \"media_io_kwargs\": { \"video\": { \"video_backend\": \"glmga\", \"backend\": \"opencv\", \"fps\": 500000, \"max_frames",
    "evidence": "osv:GHSA-58v5-2m8f-94pr",
    "products": [
      {
        "name": {
          "value": "vllm",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.30.0",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "0.23.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.24.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.25.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.25.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.26.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.27.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.27.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.28.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.29.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "GHSA-58v5-2m8f-94pr",
      "aliases": [
        "CVE-2026-105760",
        "GHSA-58v5-2m8f-94pr",
        "PYSEC-2026-4307"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0.23.0rc2"
                },
                {
                  "fixed": "0.30.0"
                }
              ]
            }
          ],
          "package": {
            "name": "vllm",
            "purl": "pkg:pypi/vllm",
            "ecosystem": "PyPI"
          },
          "versions": [
            "0.23.0",
            "0.24.0",
            "0.25.0",
            "0.25.1",
            "0.26.0",
            "0.27.0",
            "0.27.1",
            "0.28.0",
            "0.29.0"
          ],
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-58v5-2m8f-94pr/GHSA-58v5-2m8f-94pr.json"
          }
        }
      ],
      "modified": "2026-10-15T14:56:16.469138285Z",
      "provider": "osv",
      "references": [
        "https://github.com/vllm-project/vllm/security/advisories/GHSA-58v5-2m8f-94pr",
        "https://github.com/vllm-project/vllm/pull/54935",
        "https://github.com/vllm-project/vllm/commit/8b6de0eb9a09ef53f20cf06bd4d17ee264b9c2a7",
        "https://github.com/vllm-project/vllm",
        "https://github.com/vllm-project/vllm/releases/tag/v0.30.0"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-400"
        ],
        "severity": "MODERATE",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2026-10-05T23:42:55Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-105760",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 332692,
  "published_at": "2026-10-05T23:42:55+00:00"
}

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

core-osv · Original source

Published 15 Oct 2026, 10:22 UTC

## Summary The OpenAI-compatible chat endpoint accepts request-level video loader options through `media_io_kwargs`. A caller can select the GLMGA sampler and provide large `fps` and `max_frames` values. GLMGA first constructs an attacker-sized Python index list and then deduplicates it, even when the supplied video contains only a few frames. This work occurs in the shared media-loading executor before frame reads, allowing a tiny valid video and compact JSON options to consume disproportionate CPU time and memory and delay unrelated media requests. The demonstrated impact is partial denial of service. No memory corruption, data disclosure, or code execution is claimed. ## Affected configuration The server must expose chat completions for a video-capable model and accept request-level `media_io_kwargs`. The model does not need to use GLMGA by default because the request value overrides the model's loader mapping. The proof of concept uses an inline two-frame video and explicitly selects the OpenCV decoder, so no external media host or GPU decoder is required. The request is reachable without vLLM credentials when no API key is configured. With API-key authentication enabled, any caller holding a valid key can reach the same path. ## Attack surface A remote caller submits a valid chat-completion request with a small video and the following request-level options: ```json { "media_io_kwargs": { "video": { "video_backend": "glmga", "backend": "opencv", "fps": 500000, "max_frames

osv:PYSEC-2026-4307

vllm

Fixed versions: 0.30.0

Complete source record
{
  "id": "9848e507e74f4c9ac2710672829c82d51600407344b93d6fa3e4c9c3ff5b3992",
  "url": "https://osv.dev/vulnerability/PYSEC-2026-4307",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion",
    "summary": "## Summary The OpenAI-compatible chat endpoint accepts request-level video loader options through `media_io_kwargs`. A caller can select the GLMGA sampler and provide large `fps` and `max_frames` values. GLMGA first constructs an attacker-sized Python index list and then deduplicates it, even when the supplied video contains only a few frames. This work occurs in the shared media-loading executor before frame reads, allowing a tiny valid video and compact JSON options to consume disproportionate CPU time and memory and delay unrelated media requests. The demonstrated impact is partial denial of service. No memory corruption, data disclosure, or code execution is claimed. ## Affected configuration The server must expose chat completions for a video-capable model and accept request-level `media_io_kwargs`. The model does not need to use GLMGA by default because the request value overrides the model's loader mapping. The proof of concept uses an inline two-frame video and explicitly selects the OpenCV decoder, so no external media host or GPU decoder is required. The request is reachable without vLLM credentials when no API key is configured. With API-key authentication enabled, any caller holding a valid key can reach the same path. ## Attack surface A remote caller submits a valid chat-completion request with a small video and the following request-level options: ```json { \"media_io_kwargs\": { \"video\": { \"video_backend\": \"glmga\", \"backend\": \"opencv\", \"fps\": 500000, \"max_frames",
    "evidence": "osv:PYSEC-2026-4307",
    "products": [
      {
        "name": {
          "value": "vllm",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.30.0",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "0.23.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.24.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.25.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.25.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.26.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.27.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.27.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.28.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.29.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "PYSEC-2026-4307",
      "aliases": [
        "CVE-2026-105760",
        "GHSA-58v5-2m8f-94pr",
        "PYSEC-2026-4307"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0.23.0rc2"
                },
                {
                  "fixed": "0.30.0"
                }
              ]
            }
          ],
          "package": {
            "name": "vllm",
            "purl": "pkg:pypi/vllm",
            "ecosystem": "PyPI"
          },
          "versions": [
            "0.23.0",
            "0.24.0",
            "0.25.0",
            "0.25.1",
            "0.26.0",
            "0.27.0",
            "0.27.1",
            "0.28.0",
            "0.29.0"
          ],
          "database_specific": {
            "source": "https://github.com/pypa/advisory-database/blob/main/vulns/vllm/PYSEC-2026-4307.yaml"
          }
        }
      ],
      "modified": "2026-10-15T14:45:14.672244043Z",
      "provider": "osv",
      "references": [
        "https://github.com/vllm-project/vllm/security/advisories/GHSA-58v5-2m8f-94pr",
        "https://github.com/vllm-project/vllm/pull/54935",
        "https://github.com/vllm-project/vllm/commit/8b6de0eb9a09ef53f20cf06bd4d17ee264b9c2a7",
        "https://github.com/vllm-project/vllm",
        "https://github.com/vllm-project/vllm/releases/tag/v0.30.0",
        "https://pypi.org/project/vllm",
        "https://github.com/advisories/GHSA-58v5-2m8f-94pr",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-105760"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-105760",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 332659,
  "published_at": "2026-10-15T10:22:45.518163+00:00"
}