Description

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits and exhaust unaccounted GPU memory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-26T14:16:47.380Z",
  "pubdate": "2026-09-26T14:16:47.380Z",
  "executiveSummary": "This vulnerability involves a resource-limit bypass within the PyNvVideoCodec decoder allocation mechanism in vLLM versions prior to 0.29.0.\nThe flaw stems from improper handling of sampler subclasses, which enables the shadowing of decoder counters.\nAn unauthenticated attacker can manipulate video request parameters to instantiate multiple decoder instances that evade configured global resource constraints.\nThe primary impact is the exhaustion of GPU memory (VRAM), leading to potential denial-of-service (DoS) conditions for the vLLM inference engine.\nBy bypassing the accounting logic, attackers can force the system to allocate memory beyond established safety thresholds.\nThe vulnerability is exploitable remotely by unauthenticated actors without requiring elevated privileges, provided the attacker can submit video processing requests to the affected service.\nThis issue represents a significant risk to service availability in environments where vLLM is utilized for high-throughput video processing tasks.",
  "technicalDetails": "The vulnerability resides within the resource management logic governing the PyNvVideoCodec decoder allocation process. In vulnerable vLLM versions, the system maintains internal counters to track the number of active decoders and ensure GPU memory consumption remains within defined operational bounds.\nThe root cause is identified as a sampler subclass shadowing flaw. The implementation utilizes a class-based structure for managing decoders, but fails to ensure that resource counter increments are globally synchronized across all sampler subclasses.\nWhen a user submits a video request, the application initializes a sampler object to handle the decoding process. Due to the lack of strict inheritance or centralized counter enforcement, an attacker can specify alternate sampler subclasses in the request payload.\nBecause these subclasses operate as independent entities, they can initialize new decoding resources while failing to increment or correctly reference the primary, centralized global counter used by the system to enforce memory limits.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker crafts a request to the vLLM inference endpoint targeting video processing functionality. 2) The attacker intentionally selects a specific sampler subclass that is known to shadow or bypass the global accounting mechanism. 3) The application instantiates the requested decoder, which allocates significant GPU memory for processing. 4) The internal accounting system fails to update the global decoder limit, as the instantiated sampler's resource footprint remains unaccounted for in the primary registry. 5) By repeating this process, the attacker can iteratively trigger the allocation of multiple, independent decoder instances. 6) Each instance consumes a portion of the available VRAM until the GPU reaches total memory saturation.\nThe exploit allows the attacker to exceed the intended resource limits without triggering the safety mechanisms designed to reject requests when memory exhaustion is imminent. This leads to a state where the vLLM service becomes unresponsive, crashes due to OOM (Out of Memory) conditions, or causes instability across shared GPU resources if other processes are co-located on the same hardware. This bypass effectively turns the resource allocation system into a blind operator, as it no longer reflects the true physical state of memory utilization, rendering rate-limiting or service-quota policies ineffective against the exhaustion attack."
}