vLLM's Qwen2-VL/Qwen3-VL video sampler does not enforce the request-level max_frames limit, which can lead to unauthenticated memory exhaustion

vLLM's Qwen2-VL and Qwen3-VL video samplers do not enforce the existing num_frames cap on request-level max_frames, which can lead to memory exhaustion. In the advisory's CPU-only test, decoded frames increased from 60 to 900 and peak RSS increased from 2,271 MiB to 13,629 MiB; these values correspond only to that test. Paths such as /tokenize do not require vLLM API-key authentication; the Rust frontend is unaffected because it rejects the relevant media options. The GitHub advisory marks affected versions as >= 0.24.0, < 0.30.0 and the fixed version as 0.30.0.