Description
vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level min_pixels without range or min_pixels <= max_pixels validation. Its video-wide pixel budget is enforced only when max_long_side_pixel is set, and that value defaults to None. API clients can supply a large min_pixels via mm_processor_kwargs to enlarge every decoded frame, causing excessive CPU and host-memory consumption that may disrupt workers or the service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vllm-project | vllm | 0.24.0 – < 0.31.0 | 0.31.0 |
References
- GitHub Security Advisory (GHSA-w4cg-mhc7-mgw3) vendor-advisory
- VulnCheck Advisory: vLLM from 0.24.0 before 0.31.0 Resource Exhaustion via MiniMax M3 min_pixels third-party-advisory