Vulnerability Description
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits and exhaust unaccounted GPU memory.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vllm | Vllm | < 0.29.0 |
Related Weaknesses (CWE)
References
- https://github.com/vllm-project/vllm/security/advisories/GHSA-j682-9xp5-rrf3Vendor Advisory
- https://www.vulncheck.com/advisories/vllm-before-0.29.0-resource-limit-bypass-viThird Party Advisory
FAQ
What is CVE-2026-100649?
CVE-2026-100649 is a vulnerability with a CVSS score of 3.7 (LOW). vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers...
How severe is CVE-2026-100649?
CVE-2026-100649 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-100649?
Check the references section above for vendor advisories and patch information. Affected products include: Vllm Vllm.