vLLM: unbounded num_frames in openpangu video backend lets unauthenticated requests OOM-kill the API server

Impact

Requests can pick the openpangu video backend and supply a huge num_frames, which has no effective ceiling. vLLM then makes large np.linspace allocations and does heavy CPU work until the API server is OOM-killed. One request takes down the endpoint for everyone using it. It also reaches the /tokenize route, not just chat completions.

Who can reach it

Anyone who can reach /v1/chat/completions or /tokenize on a vLLM 0.30.x server. The record says no authentication is needed.

What to do

Upgrade vLLM to 0.31.0 and restart the serving processes or pods, rolling through replicas so model reloads do not drop capacity. Until then, keep the API behind authentication or a gateway that blocks the video_backend override and /tokenize from untrusted clients.

References

Related entries

• vLLM: error messages leak live server heap addresses to unauthenticated clientsCVE-2026-126395 · vLLM (sanitize_message error scrubbing, multimodal image input)Medium
• vLLM: unchecked min_pixels in MiniMax M3 VL video processing exhausts host CPU and memoryCVE-2026-126396 · vLLM (MiniMax M3 VL video processor, mm_processor_kwargs)Medium
• Hugging Face Accelerate: unsanitized shard paths in a checkpoint index give arbitrary file read and hangsCVE-2026-69112 · Hugging Face Accelerate (load_checkpoint_in_model / load_checkpoint_and_dispatch weight_map handling)Medium
• stable-diffusion.cpp: safetensors loader trusts data_offsets, reading process memory past the tensor data sectionCVE-2026-70660 · stable-diffusion.cpp safetensors loader (src/model_io/safetensors_io.cpp)Medium
• llama.cpp ggml RPC server: unvalidated tensor op and op_params in deserialize_tensorCVE-2026-78147 · llama.cpp ggml RPC server (deserialize_tensor op / op_params validation)Medium
• llama.cpp ggml RPC server: null pointer dereference in graph_compute kills the GPU workerCVE-2026-78148 · llama.cpp ggml RPC server (rpc_server::graph_compute)Medium