{"data":{"id":"fee726c3-52dc-4471-9084-fb4fa81e8fe9","title":"GHSA-m3wp-48jr-vr4g:  mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS","summary":"mistral.rs has a vulnerability where the chat completions endpoint downloads media files (images, audio, videos) from URLs without limiting how much data it stores in memory, and extracts every frame from videos when no frame limit is set. An attacker can crash the server by sending it links to infinitely-streaming files or very long high-framerate videos, exhausting the server's memory, disk space, and CPU without needing any authentication.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-m3wp-48jr-vr4g","publishedAt":"2026-09-10T21:54:37.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["mistralrs-server-core@<= 0.8.4 (fixed: 0.8.18)"],"affectedVendors":["Mistral"],"affectedVendorsRaw":["mistral.rs"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":true,"disclosureDate":"2026-09-10T21:54:37.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}