CVE-2026-100649 Overview
CVE-2026-100649 is a resource-exhaustion vulnerability in vLLM versions prior to 0.29.0. The flaw resides in the PyNvVideoCodec decoder allocation path, where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses within video requests to bypass configured decoder limits. The result is unaccounted GPU memory consumption that exhausts available resources on the inference host. The vulnerability is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling].
Critical Impact
Unauthenticated remote attackers can exhaust GPU memory on vLLM inference servers, degrading or disabling model-serving availability for all tenants.
Affected Products
- vLLM versions prior to 0.29.0
- Deployments using the PyNvVideoCodec decoder path for video inference
- Multimodal vLLM endpoints exposing video sampling to unauthenticated clients
Discovery Timeline
- 2026-09-26 - CVE-2026-100649 published to NVD
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-100649
Vulnerability Analysis
vLLM enforces decoder allocation limits to constrain how much GPU memory a request can consume through the PyNvVideoCodec pipeline. The limit is tracked via counters associated with sampler classes. Because sampler subclasses each maintain independent counters, the shared parent limit is shadowed rather than enforced globally. An attacker can rotate between subclasses on successive video requests, incrementing distinct counters while the aggregate allocation grows unbounded.
The practical outcome is GPU memory exhaustion on the inference host. Legitimate requests fail, model workers crash, and multi-tenant serving stalls. The attack requires only network reachability to the vLLM video inference endpoint and does not require authentication, though the CVSS 4.0 vector reflects high attack complexity due to the sampler-selection manipulation.
Root Cause
The root cause is improper enforcement of resource-allocation limits across inheritance hierarchies. Each sampler subclass holds its own decoder counter rather than deferring to a shared, authoritative counter. This counter shadowing voids the global cap that was intended to bound GPU memory use per request stream.
Attack Vector
An unauthenticated attacker submits video inference requests to a vulnerable vLLM server. By varying the sampler subclass across requests, the attacker allocates decoders beyond the configured limit. GPU memory consumption climbs with each request until the device is saturated. Refer to the vLLM GitHub Security Advisory GHSA-j682-9xp5-rrf3 and the VulnCheck Advisory on the vLLM Resource Limit Bypass for additional technical context.
No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose per the referenced advisories.
Detection Methods for CVE-2026-100649
Indicators of Compromise
- Sustained GPU memory utilization at or near 100% on vLLM worker nodes without a corresponding spike in legitimate request volume.
- Repeated video inference requests from a single source that rotate across distinct sampler subclass identifiers.
- CUDA out of memory errors, decoder-allocation failures, or worker restarts in vLLM logs.
Detection Strategies
- Instrument the vLLM API layer to log the sampler subclass used per request and alert on rapid subclass rotation from a single client.
- Correlate GPU memory metrics (nvidia-smi, DCGM exporter) with per-tenant request counts to identify disproportionate consumption.
- Monitor the PyNvVideoCodec decoder-allocation code path for allocations exceeding configured per-request thresholds.
Monitoring Recommendations
- Export GPU memory and decoder-slot utilization to a centralized observability platform with alerting thresholds set well below device limits.
- Track HTTP 5xx rates and worker crash counts on vLLM endpoints as proxy signals for resource-exhaustion attempts.
- Review access logs for unauthenticated access patterns to video inference endpoints and gate them behind authentication where feasible.
How to Mitigate CVE-2026-100649
Immediate Actions Required
- Upgrade vLLM to version 0.29.0 or later on all inference hosts handling video requests.
- Restrict network access to vLLM endpoints to authenticated clients and trusted networks until the upgrade is complete.
- Enable per-client rate limiting on video inference routes to cap concurrent decoder allocations.
Patch Information
The fix is included in vLLM 0.29.0. The patched release enforces decoder-allocation limits consistently across sampler subclasses, preventing counter shadowing. See the vLLM GitHub Security Advisory GHSA-j682-9xp5-rrf3 for release details.
Workarounds
- Disable the PyNvVideoCodec video decoder path if video inference is not required by the deployed workload.
- Place vLLM behind an authenticating reverse proxy and enforce request quotas per API key.
- Deploy vLLM workers with GPU memory caps per process and auto-restart policies to contain exhaustion events.
# Upgrade vLLM to the patched release
pip install --upgrade "vllm>=0.29.0"
# Verify installed version
python -c "import vllm; print(vllm.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
