{"data":{"id":"fee726c3-52dc-4471-9084-fb4fa81e8fe9","title":"GHSA-m3wp-48jr-vr4g:  mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS","summary":"The POST /v1/chat/completions endpoint in mistral.rs fetches attacker-supplied image, audio and video URLs into server memory with no byte cap, and extracts every frame of a video when num_frames is None. The route is open by default and requires no authentication, so an unauthenticated remote attacker can exhaust memory, disk and CPU, for example by pointing it at an infinite-streaming HTTP server or a long high-framerate video, causing a complete denial of service.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-m3wp-48jr-vr4g","publishedAt":"2026-09-10T21:54:37.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["mistralrs-server-core@<= 0.8.4 (fixed: 0.8.18)"],"affectedPackageNames":["mistralrs-server-core"],"affectedPackageRefs":["cargo:mistralrs-server-core"],"affectedVendors":[],"affectedVendorsRaw":["mistral.rs"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-m3wp-48jr-vr4g"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-09-10T21:54:37.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:30:42.726Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"cargo","name":"mistralrs-server-core","fixedVersion":"0.8.18","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":"registry","status":"version_not_found","checkedAt":"2026-10-29T21:30:42.580Z"}]}}