vLLM CVE-2026-105758

Requires a vLLM instance version 0.24.0 through 0.29.x running the Python frontend (the Rust frontend is explicitly NOT affected because it rejects the media_io_kwargs field) and serving a model that uses Qwen2VLVideoBackend or Qwen3VLVideoBackend - i.e. a Qwen2-VL or Qwen3-VL video-capable multimodal model. The attacker must be able to reach the /tokenize HTTP endpoint and supply request-level media_io_kwargs.video.max_frames and media_io_kwargs.video.fps values together with attacker-controlled video input. No authentication or user interaction is needed (PR:N/UI:N). The primary limiting factors are therefore deployment-specific: the server must use the Python (not Rust) frontend, must serve a Qwen video model, and must expose /tokenize to the attacker; instances serving text-only or non-Qwen-VL models, or using the Rust frontend, are not exploitable.

This is a medium-severity, availability-only denial-of-service issue, and the signals are largely consistent rather than conflicting. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, 5.3) describes a remotely reachable, low-complexity, unauthenticated attack affecting only availability, which matches the description: an unauthenticated caller submits oversized media_io_kwargs.video values to the /tokenize endpoint to exhaust frontend memory and potentially crash the API process (CWE-770, resource allocation without limits). There is no CVSS/description contradiction on reachability - both agree it is network-reachable and unauthenticated. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or weaponization; this sits in the 'patch in normal cycle' tier rather than emergency. The one nuance a defender should verify: the vendor rated availability impact as A:L, but the description says the attack can 'terminate the API process,' which is a full outage of the affected instance - repeated or scripted requests could plausibly justify A:H in some deployments, so the real-world availability impact may be slightly understated. Exploitation is also gated on a specific configuration (see exploitation_conditions), which meaningfully narrows who is actually at risk below what a raw AV:N/PR:N vector implies.

An attacker with network reachability to a vLLM Python-frontend instance serving a Qwen2-VL or Qwen3-VL video-capable model sends an unauthenticated POST to /tokenize containing media_io_kwargs.video.max_frames and .fps set far above sane limits, plus an attacker-controlled video reference. The sampler decodes every selected frame, ballooning frontend memory before any scheduling or admission control runs, and repeated requests can terminate the API process. No public exploit code was identified at time of analysis, and because low attack complexity requires no special timing, a trivial script could reproduce it against a vulnerable configuration.