CVE-2026-126396: vLLM from 0.24.0 before 0.31.0 Resource Exhaustion via MiniMax M3 min_pixels
vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level minpixels without range or minpixels <= maxpixels validation. Its video-wide pixel budget is enforced only when maxlongsidepixel is set, and that value defaults to None. API clients can supply a large minpixels via mmprocessorkwargs to enlarge every decoded frame, causing excessive CPU and host-memory consumption that may disrupt workers or the service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using vLLM versions from 0.24.0 before 0.31.0 with the MiniMax M3 VL video processor are exposed when API clients can provide mm_processor_kwargs. The vulnerable path can be reached remotely without authentication or user interaction according to the supplied severity vector.
Is the default configuration affected?
Yes. The video-wide pixel budget is enforced only when max_long_side_pixel is set, and this setting defaults to None. In that default state, a client can provide a large request-level min_pixels value.
What does an attacker need to do to trigger resource exhaustion?
An attacker needs to submit a request using mm_processor_kwargs with a large min_pixels value. The processor can then enlarge every decoded video frame, consuming excessive CPU and host memory and potentially disrupting workers or the service.
What mitigation is available if an immediate upgrade is not possible?
Configure max_long_side_pixel so that the video-wide pixel budget is enforced. This directly addresses the condition that otherwise permits unbounded frame enlargement through min_pixels.