CVE-2026-69147

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published

Aug 30, 2026, 10:00:00 PM UTC

Updated

Sep 16, 2026, 6:17:11 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.58% · Oct 25, 2026

A flaw was found in vLLM, an inference and serving engine for large language models. An attacker can exploit this by submitting specially crafted video requests that force the use of the PyNvVideoCodec GPU decoder. This bypasses the engine's static GPU memory reservation, allowing the attacker to exhaust shared GPU memory. The consequence is a denial of service (DoS), leading to request failures or worker crashes. vllm: vLLM: GPU memory exhaustion via PyNvVideoCodec decode bypass A MODERATE severity denial-of-service flaw was found in vLLM, the inference and serving engine shipped in Red Hat AI Inference Server and in Red Hat OpenShift AI (RHOAI) vLLM-based components. A remote attacker with privileges to submit requests to a video-capable GPU deployment where the PyNvVideoCodec GPU decoder is installed can send specially crafted video requests that set media_io_kwargs.video.video_backend to pynvvideocodec, forcing use of the PyNvVideoCodec decoder even when the startup configuration selected a software decoder. Because the engine reserves decoder memory only according to its static configuration, the request-selected decoder's CUDA context, decoder surfaces, and decoded-frame allocations are not removed from the KV-cache budget, allowing the attacker to exhaust shared GPU memory and cause request failures, worker crashes, or denial of service. Red Hat rated this flaw MODERATE with CVSS 3.1 score 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), consistent with the upstream rating; the impact is limited to availability, with no confidentiality or integrity impact. Affected Red Hat AI Inference Server and OpenShift AI components are marked DEFER because Red Hat does not file trackers for MODERATE severity flaws with a CVSS score below 7.0; the fix is deferred to a future product update, and the residual risk is denial of service on deployments that accept video requests on GPU hardware with PyNvVideoCodec installed. Deployments that do not process video requests or do not have the PyNvVideoCodec decoder installed are not exposed to this attack path. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.