{"id":"CVE-2026-126394","kind":"vulnerability","aliases":["CVE-2026-126394"],"related":[],"title":"vLLM: unbounded frame count lets a video request crash the API server","description":"vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vulnerability in OpenCVDynamicOpenPanguVideoBackend, which uses request-controlled num_frames without an effective ceiling. Unauthenticated attackers can send /v1/chat/completions or /tokenize requests selecting the openpangu video_backend with a huge num_frames, forcing np.linspace allocations and CPU work that OOM-kill the API server.","summary":"vLLM 0.30.0 before 0.31.0 has a video backend that takes the number of frames from the request without an upper limit. A crafted request with a huge frame count makes the server allocate large memory and use CPU until the API server is killed for running out of memory.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","python","self-hosted","vllm"],"not_affected_if":["no-public-api","version-outside-range"],"how_to_check":"- Check the installed vLLM version with `pip show vllm` and see whether it is in `0.30.0` up to but not including `0.31.0`.\n- Look for the openpangu video backend being selected (video_backend set to openpangu) in your serving configuration.","fix":"- vLLM: move to `0.31.0` or later.","status":"open","published_at":"2026-11-13T10:17:43+00:00","first_seen_at":"2026-11-13T10:47:18+00:00","triaged_at":"2026-11-13T10:54:47+00:00","updated_at":"2026-11-13T10:54:47+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-13T10:54:47Z","model":"claude-haiku-5-5","output":{"fix":"- vLLM: move to `0.31.0` or later.","reach":"internet","title":"vLLM: unbounded frame count lets a video request crash the API server","impact":"medium","summary":"vLLM 0.30.0 before 0.31.0 has a video backend that takes the number of frames from the request without an upper limit. A crafted request with a huge frame count makes the server allocate large memory and use CPU until the API server is killed for running out of memory.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["vllm","self-hosted","python"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated requests crash the API server through memory exhaustion.","analyst_note":"","how_to_check":"- Check the installed vLLM version with `pip show vllm` and see whether it is in `0.30.0` up to but not including `0.31.0`.\n- Look for the openpangu video backend being selected (video_backend set to openpangu) in your serving configuration.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-outside-range","no-public-api"],"who_is_affected":"Teams running vLLM 0.30.0 through 0.31.0 exclusive as an API server that accepts chat completion or tokenize requests from clients they do not fully trust. Deployments that are not serving the openpangu video backend are less exposed, but the sources do not say whether the flaw needs that backend to be the one selected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000748,"input_tokens":4671,"output_tokens":562,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126394':15A,18A '-2026':14A,17A '/tokenize':104C '/v1/chat/completions':102C '0.30.0':28B,77C '0.31.0':30B,79C 'ai':20B 'ai-tool':19B 'alloc':59B,118C 'api':11A,67B,127C 'attack':99C 'backend':34B,110C 'ceil':97C 'contain':80C 'control':91C 'count':4A,55B 'cpu':64B,120C 'craft':49B 'crash':9A 'cve':13A,16A 'effect':96C 'exhaust':83C 'forc':116C 'frame':3A,40B,54B,93C,115C 'host':25B 'huge':53B,113C 'kill':70B,125C 'larg':60B 'let':5A 'limit':47B 'make':56B 'memori':61B,75B 'np.linspace':117C 'num':92C,114C 'number':38B 'oom':124C 'oom-kil':123C 'opencvdynamicopenpanguvideobackend':86C 'openpangu':108C 'python':22B 'request':8A,43B,50B,90C,105C 'request-control':89C 'resourc':82C 'run':72B 'select':106C 'self':24B 'self-host':23B 'send':101C 'server':12A,58B,68B,128C 'take':36B 'tool':21B 'unauthent':98C 'unbound':2A 'upper':46B 'use':63B,88C 'video':7A,33B,109C 'vllm':1A,26B,27B,76C 'vulner':84C 'without':44B,94C 'work':121C","nicknames":[],"mitigations":[],"who_affected":"Teams running vLLM 0.30.0 through 0.31.0 exclusive as an API server that accepts chat completion or tokenize requests from clients they do not fully trust. Deployments that are not serving the openpangu video backend are less exposed, but the sources do not say whether the flaw needs that backend to be the one selected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","medium","python","selfhosted","vllm"],"campaign_type":null,"search_a":"'-126394':15A,18A '-2026':14A,17A 'api':11A 'count':4A 'crash':9A 'cve':13A,16A 'frame':3A 'let':5A 'request':8A 'server':12A 'unbound':2A 'video':7A 'vllm':1A","search_b":"'0.30.0':28B '0.31.0':30B 'ai':20B 'ai-tool':19B 'alloc':59B 'api':67B 'backend':34B 'count':55B 'cpu':64B 'craft':49B 'frame':40B,54B 'host':25B 'huge':53B 'kill':70B 'larg':60B 'limit':47B 'make':56B 'memori':61B,75B 'number':38B 'python':22B 'request':43B,50B 'run':72B 'self':24B 'self-host':23B 'server':58B,68B 'take':36B 'tool':21B 'upper':46B 'use':63B 'video':33B 'vllm':26B,27B 'without':44B","search_c":"'/tokenize':104C '/v1/chat/completions':102C '0.30.0':77C '0.31.0':79C 'alloc':118C 'api':127C 'attack':99C 'backend':110C 'ceil':97C 'contain':80C 'control':91C 'cpu':120C 'effect':96C 'exhaust':83C 'forc':116C 'frame':93C,115C 'huge':113C 'kill':125C 'np.linspace':117C 'num':92C,114C 'oom':124C 'oom-kil':123C 'opencvdynamicopenpanguvideobackend':86C 'openpangu':108C 'request':90C,105C 'request-control':89C 'resourc':82C 'select':106C 'send':101C 'server':128C 'unauthent':98C 'use':88C 'video':109C 'vllm':76C 'vulner':84C 'without':94C 'work':121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T22:24:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126394","severity":null,"published_at":"2026-11-13T10:17:43+00:00","modified_at":"2026-11-13T10:17:43+00:00","first_seen_at":"2026-11-13T10:47:18+00:00","fetched_at":"2026-11-13T10:47:18+00:00","note":null}],"documents":[{"id":110582,"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-894j-wg8m-63h8","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-10-27T22:24:06+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145031,"url":"https://www.vulncheck.com/advisories/vllm-0.30.0-before-0.31.0-resource-exhaustion-via-openpangu-video-backend-num-frames","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}