CVE-2026-126394: vLLM unbounded num_frames

CISO Take

CVE-2026-126394 is a resource exhaustion flaw in vLLM 0.30.0 up to (but not including) 0.31.0: the openpangu video backend accepts a request-controlled num_frames with no effective ceiling, so a single unauthenticated call to /v1/chat/completions or /tokenize can force huge np.linspace allocations and OOM-kill the API server. The CVSS is only 5.3 (availability impact low), but the attack is network-reachable, needs no privileges or user interaction, and takes down the whole inference endpoint, which matters for any internet-exposed or shared deployment. There is currently no public exploit, no Nuclei template, no KEV listing, and no EPSS score or SSVC decision, so there is no evidence of active exploitation, but the trigger is trivial to reproduce from the advisory. Upgrade to vLLM 0.31.0 or later; until then, put the server behind authentication, cap request body and parameter values at the gateway, and alert on API server OOM kills and restarts.

Sources:NVDGitHub AdvisoryATLASvulncheck.com

What is the risk?

Medium overall. Exploitability is high (network, low complexity, no auth, no user interaction), but the impact is limited to availability with no confidentiality or integrity loss. Exposure depends on whether vLLM is reachable by untrusted clients and whether the openpangu video backend is selectable by request. There is no known exploitation, no public PoC and no EPSS data, so likelihood is uncertain, but a crash-on-demand condition on a shared inference service can cause repeated outages. Risk rises for multi-tenant or public endpoints without a fronting gateway, and falls for internal deployments behind authentication.

How does the attack unfold?

Initial Access

Attacker reaches an exposed vLLM OpenAI-compatible endpoint without needing credentials.

AML.T0049

Exploitation

Attacker sends /tokenize or /v1/chat/completions with the openpangu video_backend and a huge num_frames value.

AML.T0034.001

Impact

np.linspace allocations and CPU work exhaust memory, the API server is OOM-killed, and inference is unavailable.

AML.T0029

Initial Access

Attacker reaches an exposed vLLM OpenAI-compatible endpoint without needing credentials.

AML.T0049

Exploitation

Attacker sends /tokenize or /v1/chat/completions with the openpangu video_backend and a huge num_frames value.

AML.T0034.001

Impact

np.linspace allocations and CPU work exhaust memory, the API server is OOM-killed, and inference is unavailable.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
96.5K93 dependentsPushed 5d ago26% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

INone

ALow

What should I do?

6 steps

Upgrade vLLM to 0.31.0 or later (see GHSA-894j-wg8m-63h8).
Until patched, do not expose vLLM directly to untrusted networks; require authentication (API keys or an authenticating reverse proxy) on /v1/chat/completions and /tokenize.
Add gateway rules that reject or cap request bodies containing a video_backend selection or an abnormally large num_frames value.
Set container or cgroup memory limits and restart policies so a crash is contained and does not affect the host.
Apply per-client rate limiting.
Detect by monitoring for OOM-kill events, unexpected server restarts, memory spikes, and requests with very large num_frames values in access logs.

How is it classified?

DoSInferenceAPIAML.T0029- Denial of AI Service AML.T0034.001- Resource-Intensive Queries AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MEASURE 2.7-AI system security and resilience are evaluated

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-126394?

CVE-2026-126394 is a resource exhaustion flaw in vLLM 0.30.0 up to (but not including) 0.31.0: the openpangu video backend accepts a request-controlled num_frames with no effective ceiling, so a single unauthenticated call to /v1/chat/completions or /tokenize can force huge np.linspace allocations and OOM-kill the API server. The CVSS is only 5.3 (availability impact low), but the attack is network-reachable, needs no privileges or user interaction, and takes down the whole inference endpoint, which matters for any internet-exposed or shared deployment. There is currently no public exploit, no Nuclei template, no KEV listing, and no EPSS score or SSVC decision, so there is no evidence of active exploitation, but the trigger is trivial to reproduce from the advisory. Upgrade to vLLM 0.31.0 or later; until then, put the server behind authentication, cap request body and parameter values at the gateway, and alert on API server OOM kills and restarts.

Is CVE-2026-126394 actively exploited?

No confirmed active exploitation of CVE-2026-126394 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-126394?

1. Upgrade vLLM to 0.31.0 or later (see GHSA-894j-wg8m-63h8). 2. Until patched, do not expose vLLM directly to untrusted networks; require authentication (API keys or an authenticating reverse proxy) on /v1/chat/completions and /tokenize. 3. Add gateway rules that reject or cap request bodies containing a video_backend selection or an abnormally large num_frames value. 4. Set container or cgroup memory limits and restart policies so a crash is contained and does not affect the host. 5. Apply per-client rate limiting. 6. Detect by monitoring for OOM-kill events, unexpected server restarts, memory spikes, and requests with very large num_frames values in access logs.

What systems are affected by CVE-2026-126394?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference APIs, multimodal/video inference, RAG pipelines, agent frameworks.

What is the CVSS score for CVE-2026-126394?

CVE-2026-126394 has a CVSS v3.1 base score of 5.3 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

model servingLLM inference APIsmultimodal/video inferenceRAG pipelinesagent frameworks

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0034.001Resource-Intensive Queries

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vulnerability in OpenCVDynamicOpenPanguVideoBackend, which uses request-controlled num_frames without an effective ceiling. Unauthenticated attackers can send /v1/chat/completions or /tokenize requests selecting the openpangu video_backend with a huge num_frames, forcing np.linspace allocations and CPU work that OOM-kill the API server.

Exploitation Scenario

An attacker discovers an internet-facing vLLM endpoint serving a multimodal model. Without any credentials, they send a /tokenize or /v1/chat/completions request selecting the openpangu video_backend with a num_frames value in the billions. The server allocates large np.linspace arrays and burns CPU, exhausting memory until the kernel OOM-kills the API process. The attacker repeats the request each time the service restarts, keeping the endpoint down and disrupting downstream applications or driving up recovery costs.

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or ThrottlingPrimary CWE-770Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.