MEDIUM 6.3 NVD
CVE-2026-100649
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent count
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits and exhaust unaccounted GPU memory.
References
- https://github.com/vllm-project/vllm/security/advisories/GHSA-j682-9xp5-rrf3
- https://www.vulncheck.com/advisories/vllm-before-0.29.0-resource-limit-bypass-via-sampler-
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-09-26 via NVD.
vulnfeed aggregates 11675 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.