GHSA-m3wp-48jr-vr4g: mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS
Summary
mistral.rs has a vulnerability where the chat completions endpoint downloads media files (images, audio, videos) from URLs without limiting how much data it stores in memory, and extracts every frame from videos when no frame limit is set. An attacker can crash the server by sending it links to infinitely-streaming files or very long high-framerate videos, exhausting the server's memory, disk space, and CPU without needing any authentication.
Classification
Affected Vendors
Affected Packages
Related Issues
CVE-2026-47482: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory
CVE-2022-29200: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implem
Original source: https://github.com/advisories/GHSA-m3wp-48jr-vr4g
First tracked: September 10, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 95%