CVE-2026-126396: vLLM resource exhaustion in MiniMax M3 VL video processor via min_pixels

Summary

vLLM versions from 0.24.0 before 0.31.0 contain a resource exhaustion flaw in the MiniMax M3 VL video processor, tracked as CVE-2026-126396. The processor accepts a request-level min_pixels value without range or min_pixels <= max_pixels validation, and its video-wide pixel budget applies only when max_long_side_pixel is set, which defaults to None. An API client can pass a large min_pixels through mm_processor_kwargs to enlarge every decoded frame, consuming excessive CPU and host memory that may disrupt workers or the service.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Inference infrastructure

Related items

• MediumCVE-2026-126399: vLLM resource exhaustion via video frame limit bypass in chat completionsSimilar attack · NVD/CVE Database
• MediumCVE-2026-126398: vLLM reachable assertion crash in GPUModelRunner via embeddings-only requestsSimilar attack · NVD/CVE Database
• HighCVE-2026-126397: vLLM denial of service via unbounded max_patches in multimodal preprocessingSimilar attack · NVD/CVE Database
• MediumCVE-2026-126394: vLLM resource exhaustion in OpenCVDynamicOpenPanguVideoBackend via num_framesSimilar attack · NVD/CVE Database
• MediumEndor Labs’ AI SAST Finds Zero Day Memory-Amplification DoS in Anthropic’s buffa library | Endor LabsSimilar attack · Endor Labs Blog