CVE-2026-69147
Fixed in a distro release EPSS <1%CVSS 6.5
vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.video.video_backend to pynvvideocodec, and MediaConnector.fetch_video forwards that choice to VideoMediaIO even when startup configuration selected a software decoder. The engine's _reserve_mm_ipc_gpu_memory logic budgets decoder memory only from static configuration, so the request-selected VIDEO_LOADER_REGISTRY backend can create a CUDA context, decoder surfaces, and decoded-frame allocations that were not removed from the engine's KV-cache budget. An attacker able to submit video requests to a video-capable GPU deployment with PyNvVideoCodec installed can exhaust shared GPU memory, causing request failures, worker crashes, or denial of service. The first release containing the fix is version 0.28.0.
Products: vllm-project vllm
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | vllm | 0.28.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | kserve-huggingfaceserver-cuda-13.3 | no fix |
| Chainguard | lmcache-cuda-12.8 | 0 |
| Chainguard | nemo-rl-cuda-13.0-vllm | no fix |
| Chainguard | py3.10-vllm-cuda-12.4 | 0 |
| Chainguard | py3.10-vllm-cuda-12.4 | 0.18.1-r8 |
| Chainguard | py3.12-vllm-cuda-12.4 | 0 |
| Chainguard | py3.12-vllm-cuda-12.4 | 0.18.1-r8 |
| Chainguard | tritonserver-backend-vllm-cuda-13.0 | 25.11-r14 |