Executive brief
mistral.rs is an OpenAI-compatible HTTP server for running AI models. The /v1/chat/completions endpoint accepts user-supplied image, audio, and video URLs and fetches them into server memory with no size limits. An unauthenticated attacker can cause complete denial of service by pointing the endpoint at an infinite-streaming HTTP server or a long high-framerate video, exhausting all server memory, disk space, and CPU within seconds.
Technical details
The vulnerability comprises three independent resource-exhaustion sinks. First, the image/audio fetch path (util.rs:59–62) uses reqwest::get(url).bytes().await?.to_vec() with no Content-Length check or streaming limit, buffering the entire response into memory. Second, the video fetch path (video.rs:65–69) uses an identical unbounded buffering pattern. Third, the FFmpeg frame extraction (video.rs:225–248) passes num_frames=None, causing every single frame of a video to be extracted to disk as PNG files. The vulnerable /v1/chat/completions route is registered with only DefaultBodyLimit (which applies only to incoming JSON, not outbound reqwest calls) and no authentication middleware. An attacker-controlled server that streams infinitely or a high-framerate long video causes OOM kill (observed in 1.3s with 256 MB limit), disk exhaustion, or CPU saturation.
Affected products
- EricLBuehler mistral.rs <= 0.8.4
Timeline
- 2026-06-21: disclosed
- 2026-09-10: advisory
- 0.8.18: patched