CVE-2026-78684: Vllm

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causing partial denial of service for concurrent requests.

Affected products

• Vllm Vllm: before 0.27.0 (fixed in 0.27.0)

Published 2026-08-25. Last modified 2026-09-29.