CVE-2026-100649

[CVE catalog]

Severity

Medium · CVSS 6.3CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Sep 13, 2026, 10:00:00 PM UTC

Updated

Sep 26, 2026, 2:16:47 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.34% · Oct 25, 2026

A flaw was found in vLLM. An unauthenticated remote attacker can cause a Denial of Service (DoS) by submitting video processing requests that specify different sampler subclasses. Because active decoder counters are tracked independently across subclasses rather than globally, requests can bypass configured hardware decoder limits. This issue allows an attacker to exhaust Graphics Processing Unit (GPU) memory, resulting in allocation failures and service disruption. vllm: vLLM: Denial of service via sampler subclass decoder limit bypass Red Hat is not impacted as our portfolio makes use of vllm versions ranging from 0.8.5-0.24.0. And none of these versions include the PyNvVideoCodec decoder-slot / sampler-subclass path. All of these only have opencv-style loaders and no pynvvideocodec. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.