CVE-2026-100649 in vLLM
Summary
by MITRE • 09/26/2026
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits and exhaust unaccounted GPU memory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The vLLM framework, prior to version 0.29.0, contains a critical resource-limit bypass vulnerability within its PyNvVideoCodec decoder allocation mechanism. This flaw stems from an architectural oversight in how the system manages video decoding resources on NVIDIA GPUs. Specifically, the vulnerability arises because different sampler subclasses can shadow one another during request processing. When unauthenticated attackers interact with the service by submitting carefully crafted video requests, they are able to select distinct sampler subclasses that operate independently of each other regarding resource accounting. This independence allows these separate instances to increment their own internal counters without being subject to the global or shared limits configured for decoder allocations. Consequently, an attacker can effectively bypass the intended resource constraints designed to protect system stability and ensure fair usage among legitimate users.
From a technical perspective, this issue represents a classic case of improper limit enforcement where logical boundaries are not strictly enforced across all execution paths. The core flaw lies in the lack of centralized state management for decoder instances spawned through different sampler subclasses. Instead of maintaining a single authoritative counter that tracks total GPU memory usage or active decoders regardless of their subclass origin, the system allows multiple independent counters to exist simultaneously. This design defect enables an unauthenticated actor to exploit the disparity by rapidly creating new decoding sessions under various sampled classes. Each session consumes GPU memory for buffer allocation and context setup, but because these allocations are not aggregated into a single limit check, they remain invisible to the resource monitoring logic that would normally throttle or reject excessive requests.
The operational impact of this vulnerability is severe, primarily manifesting as a denial-of-service condition through unaccounted GPU memory exhaustion. As attackers continue to submit malicious video requests utilizing different sampler subclasses, the cumulative effect is a rapid depletion of available VRAM on the host system. This resource starvation can lead to the crash or instability of not only the vLLM service itself but also other critical applications sharing the same GPU environment. In cloud-native deployments where resources are dynamically allocated and monitored, such uncontrolled consumption can trigger automatic scaling events, incur unexpected costs due to excessive compute usage, or cause cascading failures across dependent microservices that rely on stable inference performance. The ability of an unauthenticated user to trigger this state underscores a significant security gap in access control and resource validation layers.
This vulnerability aligns with CWE-787: Out-of-bounds Write if the memory corruption leads to instability, but more accurately maps to CWE-400: Uncontrolled Resource Consumption. The exploitation technique involves manipulating input parameters to trigger multiple independent resource allocations that evade monitoring controls. In terms of offensive security frameworks, this behavior corresponds to ATT&CK T1496: Resource Hijacking, where an adversary uses compromised or misconfigured resources for their own purposes, potentially leading to denial-of-service against legitimate users. It also touches upon aspects of ATT&CK T1053: Scheduled Task/Job if the exhaustion leads to system instability requiring manual intervention or automated remediation scripts that consume additional CPU cycles.
To mitigate this vulnerability, organizations must immediately upgrade vLLM to version 0.29.0 or later, where the developer has addressed the sampler subclass shadowing issue by implementing unified resource tracking across all decoder instances. Until an update is applied, administrators should implement strict network-level access controls to restrict unauthenticated access to the video decoding endpoints. Additionally, deploying containerized environments with hard GPU memory limits via NVIDIA Container Toolkit can provide a layer of defense in depth, ensuring that even if individual processes attempt to consume excessive VRAM, they are constrained by cgroup or Kubernetes resource quotas. Monitoring tools should be configured to alert on sudden spikes in GPU memory usage per process group rather than just total system metrics, allowing for faster detection and isolation of anomalous behavior indicative of this specific exploitation pattern.