CVE-2026-78684

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.27.0

Description The software fails to properly classify DeepStream as a GPU backend, which leads to the omission of pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream during a request to initialize the process-wide GPU decode pool and submit video content that bypasses resource controls, resulting in a partial denial of service for concurrent requests.

Recommendations Update vLLM to version 0.27.0 or later.