vLLM GPU Memory Reservation Vulnerability in PyNvVideoCodec Path

The vLLM project has disclosed a medium-severity security issue, GHSA-8pw2-6jv3-mj5j, as detailed in the GitHub Security Advisory database. This vulnerability affects the GPU memory reservation mechanism when handling inference requests that select the PyNvVideoCodec video decoder. Specifically, the issue arises because the GPU memory budgeting is calculated only during startup based on static configurations, such as `VLLM_VIDEO_LOADER_BACKEND` and optional `--mm-ipc-gpu-memory-gb` flags. However, inference requests can override the default backend dynamically via `media_io_kwargs.video.video_backend`, potentially bypassing the static VRAM reservation and leading to unexpected GPU allocations for CUDA contexts, decoder surfaces, and decoded frames.

Operators should carefully review their deployment configurations before upgrading or continuing to use the affected version. If the default OpenCV/software backend is in use and no explicit GPU memory budget has been set during startup, the system may be exposed to this vulnerability. This could result in memory contention or degraded performance for other GPU-intensive tasks, such as the engine's KV-cache operations. Verifying the backend settings and ensuring adequate GPU memory budgeting at startup are critical steps to mitigate risks associated with this issue.