CVE-2026-126396: vLLM: unbounded min_pixels in MiniMax M3 VL causes DoS

MEDIUM

Published November 13, 2026

CISO Take

vLLM 0.24.0 up to 0.31.0 lets any API client set a huge min_pixels value for the MiniMax M3 VL video processor, which inflates every decoded frame and exhausts CPU and host memory. The flaw needs no authentication or user interaction, so any exposed multimodal endpoint serving this model can be degraded by a single crafted request. Exploitation risk is moderate rather than urgent: no public exploit, Nuclei template, KEV listing or SSVC decision exists, EPSS is not yet available, and the impact is availability only (CVSS 5.3). Upgrade to vLLM 0.31.0 or later, and until then reject or clamp mm_processor_kwargs from untrusted clients and set max_long_side_pixel.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Medium. The attack is network-reachable, low complexity, needs no privileges and no user interaction, so exploitation is trivial for anyone who can reach the API. Impact is limited to availability (CVSS A:L): there is no confidentiality or integrity loss. Only deployments serving the MiniMax M3 VL model with video input are exposed. Exposure is highest for multi-tenant or public inference gateways where one tenant can starve others. There is no known in-the-wild exploitation, no public PoC, and no EPSS data, so likelihood is currently low to moderate.

How does the attack unfold?

Initial Access

Attacker reaches a vLLM multimodal API endpoint serving MiniMax M3 VL with no authentication required.

AML.T0040

Exploitation

Attacker sends a video request with a very large min_pixels value in mm_processor_kwargs, which is not range-validated.

AML.T0034.001

Impact

Every decoded frame is enlarged, exhausting CPU and host memory so workers stall or are OOM-killed and the service is denied.

AML.T0029

Initial Access

Attacker reaches a vLLM multimodal API endpoint serving MiniMax M3 VL with no authentication required.

AML.T0040

Exploitation

Attacker sends a video request with a very large min_pixels value in mm_processor_kwargs, which is not range-validated.

AML.T0034.001

Impact

Every decoded frame is enlarged, exhausting CPU and host memory so workers stall or are OOM-killed and the service is denied.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
96.5K93 dependentsPushed 5d ago26% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

INone

ALow

What should I do?

1 step

1) Upgrade vLLM to 0.31.0 or later. 2) Until patched, set max_long_side_pixel in the server configuration so the video-wide pixel budget is enforced. 3) Filter or allowlist mm_processor_kwargs at the API gateway or reverse proxy and reject min_pixels values above a safe threshold. 4) Enforce authentication, per-client rate limits and request size limits on multimodal endpoints. 5) Set container memory and CPU limits, and configure restart policies so a runaway worker does not take down the host. 6) Detect abuse by alerting on requests carrying mm_processor_kwargs with large min_pixels, and on sudden host memory or CPU spikes and worker OOM events on inference nodes.

How is it classified?

DoSInferenceAPIAML.T0029- Denial of AI Service AML.T0034.001- Resource-Intensive Queries AML.T0040- AI Model Inference API Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MEASURE 2.7-AI system security and resilience evaluated

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-126396?

Is CVE-2026-126396 actively exploited?

No confirmed active exploitation of CVE-2026-126396 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-126396?

1) Upgrade vLLM to 0.31.0 or later. 2) Until patched, set max_long_side_pixel in the server configuration so the video-wide pixel budget is enforced. 3) Filter or allowlist mm_processor_kwargs at the API gateway or reverse proxy and reject min_pixels values above a safe threshold. 4) Enforce authentication, per-client rate limits and request size limits on multimodal endpoints. 5) Set container memory and CPU limits, and configure restart policies so a runaway worker does not take down the host. 6) Detect abuse by alerting on requests carrying mm_processor_kwargs with large min_pixels, and on sudden host memory or CPU spikes and worker OOM events on inference nodes.

What systems are affected by CVE-2026-126396?

This vulnerability affects the following AI/ML architecture patterns: model serving, multimodal inference, LLM inference APIs, video understanding pipelines.

What is the CVSS score for CVE-2026-126396?

CVE-2026-126396 has a CVSS v3.1 base score of 5.3 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

model servingmultimodal inferenceLLM inference APIsvideo understanding pipelines

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0034.001Resource-Intensive Queries

AML.T0040AI Model Inference API Access

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level min_pixels without range or min_pixels <= max_pixels validation. Its video-wide pixel budget is enforced only when max_long_side_pixel is set, and that value defaults to None. API clients can supply a large min_pixels via mm_processor_kwargs to enlarge every decoded frame, causing excessive CPU and host-memory consumption that may disrupt workers or the service.

Exploitation Scenario

An attacker finds an internet-exposed or weakly authenticated vLLM endpoint serving MiniMax M3 VL. They submit a chat completion request with a short video and set mm_processor_kwargs.min_pixels to an extremely large value. The processor upscales every decoded frame, consuming large amounts of CPU and host memory. By repeating this a few times concurrently, the attacker exhausts memory, causing workers to hang or be OOM-killed and denying service to legitimate users.

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or ThrottlingPrimary CWE-770Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.