23 matches found
Allocation of Resources Without Limits or Throttling
Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via PyNvVideoCodecVideoBackendMixin, where sampler subclass shadowing causes independent...
CVE-2026-100649
A flaw was found in vLLM. An unauthenticated remote attacker can cause a Denial of Service DoS by submitting video processing requests that specify different sampler subclasses. Because active decoder counters are tracked independently across subclasses rather than globally, requests can bypass...
CVE-2026-100649
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...
CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...
CVE-2026-100649
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...
EUVD-2026-87743
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...
CVE-2026-100649
Versions of vLLM prior to 0.29.0 are vulnerable to a resource-limit bypass within the PyNvVideoCodec decoder allocation. The root cause is sampler subclass shadowing , which allows for independent counter increments rather than global tracking. An unauthenticated remote attacker can exploit this ...
CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...
CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...
CVE-2026-100649: Allocation of Resources Without Limits or Throttling
vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...
PT-2026-99320
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.0 Description A resource-limit bypass exists in the PyNvVideoCodec decoder allocation. This issue occurs because sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select...
SUSE CVE-2026-94627
vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts,...
CVE-2026-94627
A flaw was found in vLLM. A remote attacker can exploit a vulnerability in the Mooncake connector's management of GPU Key-Value KV cache block ownership. By submitting completion requests with multiple prompts that share a single transfer ID, attackers can cause orphaned KV cache blocks to...
EUVD-2026-84221
vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts,...
CVE-2026-94627
vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts,...
CVE-2026-94627
vLLM Mooncake connector (through version 0.29.0) fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. An unauthenticated remote attacker can trigger GPU memory exhaustion by submitting completi...
CVE-2026-94627 vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision
vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts,...
PT-2026-96317
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.1 Description The Mooncake connector fails to properly manage GPU KV cache block ownership during prefill/decode disaggregated deployments when concurrent child requests share a single transfer ID. An attacker can...
EUVD-2026-80935
vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation...
CVE-2026-69147
A flaw was found in vLLM, an inference and serving engine for large language models. An attacker can exploit this by submitting specially crafted video requests that force the use of the PyNvVideoCodec GPU decoder. This bypasses the engine's static GPU memory reservation, allowing the attacker to...