vLLM GLMGA video sampling vulnerability can exhaust CPU and memory
Start here
On October 6, 2026, a GitHub security advisory disclosed a denial-of-service vulnerability in vLLM's GLMGA video sampler: the sampler constructs an index list from request-controlled sampling parameters, then deduplicates and reads the video, so even a small video with overly large parameters can consume disproportionate CPU time and memory, delaying other media requests and causing partial denial of service. The advisory does not report memory corruption, data leakage, or code execution. Affected versions are >= 0.23.0rc2, < 0.30.0, with the fix in 0.30.0; video options can be filtered at the gateway, and untrusted clients can be restricted from selecting this sampler.
Generated by AI from reports · Updated 2 days ago
Progress timeline
- GitHub 安全公告SelectedvLLM discloses a GLMGA video sampling vulnerability that can cause request-driven CPU and memory exhaustion
vLLM's GLMGA video sampler constructs an index list based on request-controlled sampling parameters, then deduplicates and reads the video. Small videos combined with overly large parameters can also consume disproportionate CPU time and memory, delaying other media requests and causing partial denial of service. The advisory does not report memory corruption, data leakage, or code execution; video options can be filtered at the gateway, and untrusted clients can be restricted from selecting this sampler. The GitHub advisory marks affected versions as >= 0.23.0rc2, < 0.30.0, with the fixed version being 0.30.0.
Related discussion
Attention trend
New sources per day
- Oct 6New1 sources (1 outlets,0 accounts)
- Oct 7New0 sources (0 outlets,0 accounts)
- Oct 8New0 sources (0 outlets,0 accounts)
- Oct 9New0 sources (0 outlets,0 accounts)
- Oct 10New0 sources (0 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New0 sources (0 outlets,0 accounts)
- Oct 13New0 sources (0 outlets,0 accounts)