CVE-2026-100649: vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler sub

vLLM (a system for running large language models) versions before 0.29.0 have a security flaw in its video processing component where attackers can bypass resource limits by selecting different sampler subclasses (variations of code that handle sampling) in video requests, causing the system to use more GPU memory than it should. Unauthenticated attackers (those without login credentials) can exploit this to crash or degrade the service by exhausting available GPU resources.