Vllm · Vllm · CVE-2026-78684
**Name of the Vulnerable Software and Affected Versions**
vLLM versions prior to 0.27.0
**Description**
The software fails to properly classify DeepStream as a GPU backend, which leads to the omission of pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream during a request to initialize the process-wide GPU decode pool and submit video content that bypasses resource controls, resulting in a partial denial of service for concurrent requests.
**Recommendations**
Update vLLM to version 0.27.0 or later.