{
 "id": "AIR-2026-0138",
 "slug": "cve-2026-69147-vllm-video-backend-gpu-memory-allocation-flaw",
 "title": "CVE-2026-69147: vLLM video backend GPU memory allocation flaw",
 "summary": "A vulnerability in vLLM prior to version 0.28.0 allows chat completion requests to force unexpected video backend decoders. This bypasses static GPU memory budgeting and can lead to unmanaged CUDA allocations.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "vLLM"
 ],
 "incident_date": "2026-09-16",
 "incident_date_precision": "day",
 "first_reported": "2026-09-16",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69147",
   "publisher": "NVD",
   "title": "CVE-2026-69147: vLLM is an inference and serving engine for large language models.",
   "published_at": "2026-09-16"
  },
  {
   "url": "https://github.com/advisories/GHSA-8pw2-6jv3-mj5j",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-69147: vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation",
   "published_at": "2026-09-17"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-69147",
  "vllm",
  "denial-of-service"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T07:00:14.101Z"
}