Vulnerability in vllm-project vllm

[ Description ]Official description

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits and exhaust unaccounted GPU memory.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/vllm-project/vllm/security/advisories/GHSA-j682-9xp5-rrf3Vendor Advisory
• www.vulncheck.com/advisories/vllm-before-0.29.0-resource-limit-bypass-via-sampler-subclassThird Party Advisory