CVE-2026-100649 describes a resource-limit bypass vulnerability in vLLM prior to version 0.29.0. The issue arises in the PyNvVideoCodec decoder allocation where sampler subclass shadowing permits independent counter increments. Attackers without authentication can select different sampler subclasses in video requests to bypass configured decoder limits, leading to unaccounted GPU memory exhaustion.

An unauthenticated attacker can exploit this vulnerability to exceed decoder resource limits, causing GPU memory exhaustion. This could degrade system performance or cause denial of service conditions due to resource depletion. There is no indication of direct code execution or data compromise from the provided information.

No explicit patch or remediation is stated in the provided data. Users should upgrade to vLLM version 0.29.0 or later once available, as the vulnerability affects versions prior to 0.29.0. Until then, monitor vendor advisories for official fixes or temporary mitigations. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.