vLLM: VLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder…
vLLM
More for vLLM RSS feed for vLLM
- Severity
- Medium, CVSS 5.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Record
- CVE-2026-100649
- Affects
- vLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 26, 2026
- Source last modified
- October 6, 2026
Description
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits and exhaust unaccounted GPU memory.
Description quoted from the NVD record.