vLLM discloses a GLMGA video sampling vulnerability that can cause request-driven CPU and memory exhaustion
vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion
vLLM's GLMGA video sampler constructs an index list based on request-controlled sampling parameters, then deduplicates and reads the video. Small videos combined with overly large parameters can also consume disproportionate CPU time and memory, delaying other media requests and causing partial denial of service. The advisory does not report memory corruption, data leakage, or code execution; video options can be filtered at the gateway, and untrusted clients can be restricted from selecting this sampler. The GitHub advisory marks affected versions as >= 0.23.0rc2, < 0.30.0, with the fixed version being 0.30.0.
The announcement gives the cause and fix recommendations for the denial-of-service in the vLLM video sampling interface, and teams deploying multimodal inference services can use this to check request-level parameter boundaries.