CVE-2026-126396

vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level min_pixels without range or min_pixels <= max_pixels validation. Its video-wide pixel budget is enforced only when max_long_side_pixel is set, and that value defaults to None. API clients can supply a large min_pixels via mm_processor_kwargs to enlarge every decoded frame, causing excessive CPU and host-memory consumption that may disrupt workers or the service.

• CWE-770

• https://github.com/vllm-project/vllm/security/advisories/GHSA-w4cg-mhc7-mgw3
• https://www.vulncheck.com/advisories/vllm-from-0.24.0-before-0.31.0-resource-exhaustion-via-minimax-m3-min-pixels

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126390n8n before 1.123.89 contains a credential leakage vulnerabil…3.7
• CVE-2026-126391n8n before 1.123.89 contains an insufficient isolation vulne…7.5
• CVE-2026-126392Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 conta…3.1
• CVE-2026-126393SiYuan before 3.8.10 contains a server-side request forgery …6.1
• CVE-2026-126394vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vul…5.3
• CVE-2026-126395vLLM from 0.14.0rc1 before 0.31.0 contains an information di…5.3
• CVE-2026-126397vLLM from 0.10.1 before 0.31.0 forwards a request-controlled…7.5
• CVE-2026-126398vLLM from 0.28.0 before 0.30.0 contains a reachable assertio…5.9
• CVE-2026-126399vLLM from 0.19.0 before 0.31.0 contains a resource exhaustio…6.5
• CVE-2026-1264IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.…6.5
• CVE-2026-126400Password Pusher from 1.49.0 before 2.17.0 contains an IP spo…3.7
• CVE-2026-126401Fleet before 4.86.2 contains a denial of service vulnerabili…7.5