Executive brief
vLLM is an inference serving framework for large language models that supports video input processing. A vulnerability allows clients to force GPU video decoding via the PyNvVideoCodec backend even when the server was not configured to reserve GPU memory for that decoder at startup. On servers running near capacity, an attacker could trigger unexpected GPU memory consumption, causing request failures, worker crashes, or complete service unavailability.
Technical details
The vulnerability is a resource reservation bypass in the media input pipeline. vLLM's engine worker computes GPU memory budgets at startup based only on static configuration and environment variables, specifically checking whether PyNvVideoCodec is listed in startup config to decide whether to reserve decoder surface and CUDA context memory. However, the request-handling code honors a runtime `media_io_kwargs.video.video_backend` parameter from the client, allowing an ordinary chat completion request to override the video backend to "pynvvideocodec" even if the engine never reserved memory for that decoder. When the GPU decoder loads, it allocates context, decoder surfaces, and frame buffers outside the engine's pre-computed budget. The attack requires network access to the video API endpoint, an authenticated request capability (unless the deployment is unauthenticated), and a GPU with PyNvVideoCodec available; no code execution or data disclosure occurs.
Affected products
- vLLM Project vLLM main builds after commit af16446bf (not yet in any released version)
Timeline
- 2026-09-17: disclosed: GitHub Security Advisory GHSA-8pw2-6jv3-mj5j published
- 2026-06-26: other: Introducing commit af16446bf merged (VRAM semaphore infra PR #44465)