Resource Exhaustion in vLLM via OpenPangu Video Backend

Executive Summary

This vulnerability is a resource exhaustion issue in vLLM versions 0.30.0 through 0.30.x before 0.31.0. It occurs in the OpenCVDynamicOpenPanguVideoBackend where the num_frames parameter is not properly limited. Unauthenticated attackers can exploit this by sending requests with a very large num_frames value to /v1/chat/completions or /tokenize endpoints. This causes excessive memory allocations and CPU processing, leading to out-of-memory conditions that crash the API server.

Useful 0 Not Useful 0

Detection Guidance

Monitor API server logs for requests to /v1/chat/completions or /tokenize with unusually large num_frames values in OpenPangu video_backend. Check for excessive CPU usage or memory spikes during video processing. Use network traffic analysis to detect repeated requests with extreme num_frames parameters.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial-of-service by crashing the API server due to resource exhaustion. Attackers can force the system to allocate excessive memory and CPU, leading to out-of-memory kills. Systems using vLLM 0.30.0 to 0.30.x with video capabilities are particularly affected, as the backend is accessible without authentication or model requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade vLLM to version 0.31.0 or later. Implement input validation to cap num_frames values. Restrict access to video_backend endpoints. Monitor for OOM conditions and block suspicious requests with high num_frames.

Useful 0 Not Useful 0