vLLM Improper Frame Limit in Video/JPEG Decoding Leads to OOM Crash
Overview
The VideoMediaIO.load_base64() method in vLLM versions 0.7.0 through 0.18.x is vulnerable to a denial-of-service attack due to an unhandled exception in processing video/jpeg data URLs. Specifically, the function splits base64-encoded JPEG data by commas, treating each segment as a separate frame. However, it fails to impose a limit on the number of frames that can be processed, unlike the load_bytes() code path which correctly enforces a `num_frames` parameter. An attacker can exploit this by submitting a malicious API request containing a large number of comma-separated base64-encoded JPEG frames. When the server attempts to decode these thousands of frames, it will exhaust available memory, leading to an Out-of-Memory (OOM) crash and rendering the service unavailable. This bypasses intended resource limits and can be triggered with a single request.
Affected Systems
Testing Guide
1. Ensure you are running a vulnerable version of vLLM (0.7.0 to 0.18.x). 2. Construct a malicious input string containing a large number of comma-separated, valid base64-encoded JPEG frame data. The number of frames should significantly exceed the default `num_frames` (e.g., thousands or tens of thousands). 3. Send this crafted string as part of a video/jpeg data URL in an API request to the vLLM server. 4. Observe the vLLM server's resource usage (memory) and check for any crashes or unresponsiveness. A successful exploit will result in an Out-of-Memory (OOM) error and a server crash.
Mitigation Steps
- Update vLLM to version 0.19.0 or later. - Implement input validation for the number of frames in video/jpeg data URLs before processing. - Configure server-side resource limits (e.g., memory, CPU) to prevent OOM conditions. - Consider deploying a Web Application Firewall (WAF) with rules to detect and block excessively large or malformed requests. - Isolate vLLM deployments in controlled environments with strict resource allocation.
Patch Details
vLLM 0.19.0