Allocation of Resources Without Limits or Throttling Affecting tritonserver-backend-vllm-cuda-13.0 package, versions <25.11-r17

Note: Versions mentioned in the description apply only to the upstream tritonserver-backend-vllm-cuda-13.0 package and not the tritonserver-backend-vllm-cuda-13.0 package as distributed by Chainguard. See How to fix? for Chainguard relevant fixed versions and status.

vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs.video.fps fields without enforcing server-side ceilings. An unauthenticated caller can submit these values to the /tokenize endpoint, causing the sampler to decode every frame selected from attacker-controlled video input, consume disproportionate frontend memory, and potentially terminate the API process before scheduling or admission control. The Rust frontend is not affected because it rejects the media_io_kwargs field. This issue is fixed in version 0.30.0.

• https://github.com/vllm-project/vllm/commit/ea723c81c3ea26425cb69503a5d5e90822a04a45
• https://github.com/vllm-project/vllm/pull/56729
• https://github.com/vllm-project/vllm/releases/tag/v0.30.0
• https://github.com/vllm-project/vllm/security/advisories/GHSA-x6mc-67gf-chw4