CVE-2026-116179

Limit exposure of the vLLM service by restricting network reachability to trusted callers and placing model endpoints behind an authenticating gateway.

1. Implement network access controls:
Apply Kubernetes NetworkPolicies in OpenShift AI clusters or configure firewall rules to permit only verified internal workloads to reach the serving port. On standalone environments, limit access to trusted client subnets using firewalld:

# firewall-cmd --zone=trusted --add-source=<trusted_ip_range> --permanent
# firewall-cmd --zone=public --remove-port=<serving_port>/tcp --permanent
# firewall-cmd --reload

2. Operational controls:
Route API requests through an authenticating reverse proxy or API gateway to enforce client authentication and filter out unexpected multimodal payloads before they reach the inference backend.

Caveats:
Restricting network access will block requests originating outside approved subnets or from unauthenticated services.

Warning: Reloading firewall configurations or applying network policy changes may temporarily disconnect active client sessions.

--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to reject or enforce strict bounds on media decoding parameters such as num_frames in media_io_kwargs at the vLLM API frontend before passing to VideoMediaIO: upgrade to vLLM 0.31.0+ (or the corresponding fixed Red Hat builds), which reject non-empty per-request media_io_kwargs by default unless --trust-request-mm-kwargs is explicitly enabled, closing all 2 injection vectors (overriding num_frames to -1 via request media_io_kwargs, specifying an arbitrarily large num_frames value via request media_io_kwargs). Until patched, this is only a concern on deployments hosting multimodal models supporting video inputs — workloads configured exclusively for text-only language models are unaffected — so restrict API network access to trusted callers using firewall rules or NetworkPolicies, require authentication via an API gateway, and filter out untrusted multimodal payloads. As a compensating measure, monitor cgroup memory pressure metrics to detect rapid memory consumption and impending OOM conditions before host exhaustion occurs, configure systemd watchdog and restart policies to automatically restart the API service if terminated by the OOM killer, and constrain container memory under cgroups v2 resource limits to prevent runaway video frame decoding from exhausting host-wide memory. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded video frame decoding resource exhaustion defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)