Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via PyNvVideoCodecVideoBackendMixin, where sampler subclass shadowing causes independent...

CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

CVE-2026-100649

Versions of vLLM prior to 0.29.0 are vulnerable to a resource-limit bypass within the PyNvVideoCodec decoder allocation. The root cause is sampler subclass shadowing , which allows for independent counter increments rather than global tracking. An unauthenticated remote attacker can exploit this ...

EUVD-2026-87743

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

CVE-2026-100649

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

CVE-2026-100649 vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits an...

PT-2026-99320

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.0 Description A resource-limit bypass exists in the PyNvVideoCodec decoder allocation. This issue occurs because sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select...