CVE-2026-126394

OpenPangu video preprocessing could exhaust inference server memory

vLLM · OpenPangu video backend

First documented disclosure · Review checkpoint

Summary

The backend accepted client-selected frame counts without a ceiling. One client could exhaust CPU or memory and interrupt video inference for others.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources describe the weakness and correction. They identify no confirmed malicious use.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The backend accepted client-selected frame counts without a ceiling.

Conditions required

The deployment accepts video inputs and permits clients to select the affected preprocessing settings.

Potential impact

One client could exhaust CPU or memory and interrupt video inference for others.

Affected versions and configurations

0.30.0 through releases before 0.31.0.

Fix and mitigation status

0.31.0 for this issue.

Practical next steps

Use a supported vLLM release containing the 0.31.0 fix. Keep client-controlled multimodal settings disabled for untrusted users.

Operating lesson

Keep video sampling limits under operator control across all selectable backends.

Evidence and limits

A September mitigation covered a class of multimodal settings. The October project notice describes this processor-specific exposure. The issuing CNA published the CVE record on 2026-11-13.

Sources