Jpengli

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.29.0 **Description** A resource-limit bypass exists in the PyNvVideoCodec decoder allocation. This issue occurs because sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits, leading to the exhaustion of unaccounted GPU memory. **Recommendations** Update vLLM to version 0.29.0 or later.

**Name of the Vulnerable Software and Affected Versions** vLLM versions 0.26.0 through 0.27.0 **Description** A resource consumption issue exists in the MoRIIO Acknowledgement Handler component within the file vllm/distributed/kv transfer/kv connector/v1/moriio/moriio connector.py. A remote attacker can trigger this by manipulating the `request id` or `kv transfer params` arguments. The affected functions include `MoRIIOConnectorScheduler.request finished()`, `MoRIIOConnectorWorker.get finished()`, and `MoRIIOWrapper. handle release message()`. **Recommendations** As a temporary mitigation, restrict access to the `MoRIIOConnectorScheduler.request finished()`, `MoRIIOConnectorWorker.get finished()`, and `MoRIIOWrapper. handle release message()` functions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** vllm versions prior to 0.30.0 **Description** A remote attack can be launched against the `vllm/v1/sample/thinking budget state.py` file, leading to inefficient algorithmic complexity. This condition occurs when certain functionality within the file is manipulated, causing the system to consume resources inefficiently. **Recommendations** Update to version 0.30.0.