vLLM: unchecked min_pixels in MiniMax M3 VL video processing exhausts host CPU and memory

Impact

The MiniMax M3 VL video processor accepts min_pixels from the request (via mm_processor_kwargs) without checking its range or that it is no larger than max_pixels. The video-wide pixel budget only applies when max_long_side_pixel is set, and that defaults to None. A client can therefore inflate every decoded frame and use up host CPU and RAM. Frame decoding happens on the host, so one request can starve or crash the worker serving every other tenant on that replica. Only deployments serving the MiniMax M3 VL model are affected.

Who can reach it

Any API client that can send video requests to a vLLM instance serving MiniMax M3 VL. Authentication is whatever the deployment enforces, and the record states none is needed.

What to do

Upgrade vLLM to 0.31.0 or later, which affects 0.24.0 through 0.30.x, and restart each serving replica. Until then, set max_long_side_pixel to enforce the video pixel budget, or strip mm_processor_kwargs from untrusted requests at the gateway.

References

Related entries

• Hugging Face Accelerate: unsanitized shard paths in a checkpoint index give arbitrary file read and hangsCVE-2026-69112 · Hugging Face Accelerate (load_checkpoint_in_model / load_checkpoint_and_dispatch weight_map handling)Medium
• stable-diffusion.cpp: safetensors loader trusts data_offsets, reading process memory past the tensor data sectionCVE-2026-70660 · stable-diffusion.cpp safetensors loader (src/model_io/safetensors_io.cpp)Medium
• llama.cpp ggml RPC server: unvalidated tensor op and op_params in deserialize_tensorCVE-2026-78147 · llama.cpp ggml RPC server (deserialize_tensor op / op_params validation)Medium
• llama.cpp ggml RPC server: null pointer dereference in graph_compute kills the GPU workerCVE-2026-78148 · llama.cpp ggml RPC server (rpc_server::graph_compute)Medium
• BentoML: SSRF filter misses 100.64.0.0/10, so serving pods fetch from internal CGNAT hostsCVE-2026-78205 · BentoML make_safe_connect (SSRF address filter, RFC 6598 range)Medium
• vLLM: DeepStream backend misclassification skips pixel limits and lets unauthenticated video exhaust GPU decodeCVE-2026-78684 · vLLM (DeepStream GPU decode path, pixel-limit enforcement)Medium