Low severity3.7NVD Advisory· Published Sep 26, 2026· Updated Oct 6, 2026
CVE-2026-100649
CVE-2026-100649
Description
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits and exhaust unaccounted GPU memory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
2- github.com/vllm-project/vllm/security/advisories/GHSA-j682-9xp5-rrf3nvdVendor Advisory
- www.vulncheck.com/advisories/vllm-before-0.29.0-resource-limit-bypass-via-sampler-subclassnvdThird Party Advisory
News mentions
1- VLLM: Eight Vulnerabilities Disclosed Together, Patch Released in 0.29.0Vypr Intelligence · Sep 26, 2026