CVE-2026-126394: vLLM 0.30.0 before 0.31.0 Resource Exhaustion via OpenPangu Video Backend num_frames
vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vulnerability in OpenCVDynamicOpenPanguVideoBackend, which uses request-controlled numframes without an effective ceiling. Unauthenticated attackers can send /v1/chat/completions or /tokenize requests selecting the openpangu videobackend with a huge numframes, forcing np.linspace allocations and CPU work that OOM-kill the API server.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
API servers that expose /v1/chat/completions or /tokenize and allow requests to select the openpangu video_backend are exposed. No credentials or user interaction are required.
What does an attacker need to send?
An attacker needs to submit a request using the openpangu video backend with a very large num_frames value. The request-controlled value can trigger np.linspace allocations and CPU work.
What is the practical impact on an affected server?
The API server can consume sufficient memory and CPU resources to be OOM-killed, causing denial of service. The provided information identifies no confidentiality or integrity impact.
What versions are affected?
The affected range is vLLM 0.30.0 before 0.31.0. Version 0.31.0 is not included in the stated affected range.