vLLM: VLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit…
vLLM
More for vLLM RSS feed for vLLM
- Severity
- Medium, CVSS 5.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Record
- CVE-2026-78684
- Affects
- vLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 25, 2026
- Source last modified
- September 29, 2026
Description
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causing partial denial of service for concurrent requests.
Description quoted from the NVD record.