vLLM Qwen video sampler max_frames has no upper limit, leading to memory exhaustion DoS

1. 07:42
   GitHub 安全公告Selected

   vLLM's Qwen2-VL/Qwen3-VL video sampler does not enforce the request-level max_frames limit, which can lead to unauthenticated memory exhaustion

   vLLM's Qwen2-VL and Qwen3-VL video samplers do not enforce the existing num_frames cap on request-level max_frames, which can lead to memory exhaustion. In the advisory's CPU-only test, decoded frames increased from 60 to 900 and peak RSS increased from 2,271 MiB to 13,629 MiB; these values correspond only to that test. Paths such as /tokenize do not require vLLM API-key authentication; the Rust frontend is unaffected because it rejects the relevant media options. The GitHub advisory marks affected versions as >= 0.24.0, < 0.30.0 and the fixed version as 0.30.0.

Current attention62·Peak in the comparable period63（Oct 7 12:00）·Change over the comparable past 24 hours 0%