CVE-2026-69147: vLLM GPU memory exhaustion through request-selected video decoder backend

Summary

vLLM versions prior to 0.28.0 let Chat Completions and Responses request bodies select the pynvvideocodec video backend through media_io_kwargs.video.video_backend, even when startup configuration chose a software decoder. The engine budgets decoder GPU memory only from static configuration, so the request-selected backend's CUDA context, decoder surfaces and decoded-frame allocations escape the KV-cache budget. An attacker who can submit video requests to a video-capable GPU deployment with PyNvVideoCodec installed can exhaust shared GPU memory, causing request failures, worker crashes or denial of service.

Mitigation

Fixed in 0.28.0.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• vllmPyPILLM dependency since 2023-08-25 · 15 tracked dependents

Topics

• Inference infrastructure

Related items

• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence
• InfoThe Blind Spots of Detection: Adversarial Perturbation Attacks against Watchdogs in Distributed LLM InferenceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• HighCVE-2026-118761: Kubeflow Pipelines decompression bomb in pipeline archive uploadSimilar attack · NVD/CVE Database
• LowOpenCode User Hit with Hostile Backlash After Reporting Free AI LoopholeSimilar attack · Socket Blog