PyPI/vllm CVE-2026-69147: medium 6.5, EPSS 0.58%
vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation
Action: Upgrade vllm to 0.28.0 or later.
pip install vllm==0.28.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.28.0 | - |
Fixed versions
| 0.28.0 |
Sources
- osv: GHSA-8pw2-6jv3-mj5j
- https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j
- https://nvd.nist.gov/vuln/detail/CVE-2026-69147
- https://github.com/vllm-project/vllm/pull/47259
- https://github.com/vllm-project/vllm/commit/283893c72292ede38d277e3cd2b9b64c3e4f1dda
- https://github.com/vllm-project/vllm/commit/ba22152096b2484faa3579624a253d54804d876d
- https://github.com/vllm-project/vllm
- https://github.com/vllm-project/vllm/releases/tag/v0.25.0
CVE-2026-69147 · published · modified · JSON