EUVD-2026-80935Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable request with no built-in auth maps to PR:L and AC:L; impact is pure GPU-memory exhaustion (A:H) with no confidentiality or integrity effect, and no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.video.video_backend to pynvvideocodec, and MediaConnector.fetch_video forwards that choice to VideoMediaIO even when startup configuration selected a software decoder. The engine's _reserve_mm_ipc_gpu_memory logic budgets decoder memory only from static configuration, so the request-selected VIDEO_LOADER_REGISTRY backend can create a CUDA context, decoder surfaces, and decoded-frame allocations that were not removed from the engine's KV-cache budget. An attacker able to submit video requests to a video-capable GPU deployment with PyNvVideoCodec installed can exhaust shared GPU memory, causing request failures, worker crashes, or denial of service. The first release containing the fix is version 0.28.0.
AnalysisAI
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS vector) force the server to load the PyNvVideoCodec hardware video decoder on demand by setting media_io_kwargs.video.video_backend to 'pynvvideocodec' in a Chat Completions or Responses request, even when the operator configured a software decoder at startup. Because the engine budgets decoder VRAM only from static configuration, the request-selected backend allocates a CUDA context, decoder surfaces, and decoded-frame buffers that were never deducted from the KV-cache budget, so repeated video requests can exhaust shared GPU memory and cause request failures, worker crashes, and denial of service. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a specific, non-default multimodal stack: (1) a vLLM deployment before 0.28.0 that is video-capable and serving a model accepting video input via Chat Completions or Responses; (2) the PyNvVideoCodec library actually installed on the GPU host; and (3) startup configuration having selected a software video decoder (the bug is that the request-level 'pynvvideocodec' backend overrides this without being memory-budgeted). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability-only issue, not a high-priority critical flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade vLLM to 0.28.0 or later, which contains the merge_kwargs policy change that strips request-level 'video_backend'/'backend' values requiring the GPU unless they match the startup configuration - apply it via the vendor advisory at https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j or by picking up pull request https://github.com/vllm-project/vllm/pull/47259 (commits 283893c72292ede38d277e3cd2b9b64c3e4f1dda and ba22152096b2484faa3579624a253d54804d876d). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Vllm versions up to 0.12.0 is affected by allocation of resources without limits or throttling (CVSS 6.5).
Race condition in vLLM's prompt embedding loader allows concurrent API requests to bypass the sparse tensor invariant gu
Remote code execution in vLLM 0.10.1 through 0.13.x lets an attacker who controls the model repository or path run arbit
Server-Side Request Forgery in vLLM's multimodal MediaConnector allows remote attackers to coerce the inference server i
Denial of service in vllm 0.19.0's OpenAI-compatible serving path allows remote unauthenticated attackers to exhaust sch
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today