CVE-2026-78684

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-78684
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causing partial denial of service for concurrent requests.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/vllm-project/vllm/commit/e23b19309b8705b21c3b3ff4129c9974ba15a419 Patch
https://github.com/vllm-project/vllm/security/advisories/GHSA-cqm8-jxg6-fqfq Vendor Advisory
https://www.vulncheck.com/advisories/vllm-before-denial-of-service-via-deepstream-backend Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*
History

29 Sep 2026, 12:52

Type Values Removed Values Added
CPE cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*
First Time Vllm vllm
Vllm
References () https://github.com/vllm-project/vllm/commit/e23b19309b8705b21c3b3ff4129c9974ba15a419 - () https://github.com/vllm-project/vllm/commit/e23b19309b8705b21c3b3ff4129c9974ba15a419 - Patch
References () https://github.com/vllm-project/vllm/security/advisories/GHSA-cqm8-jxg6-fqfq - () https://github.com/vllm-project/vllm/security/advisories/GHSA-cqm8-jxg6-fqfq - Vendor Advisory
References () https://www.vulncheck.com/advisories/vllm-before-denial-of-service-via-deepstream-backend - () https://www.vulncheck.com/advisories/vllm-before-denial-of-service-via-deepstream-backend - Third Party Advisory

28 Sep 2026, 23:10

Type Values Removed Values Added
Summary
  • (es) vLLM anterior a la versión 0.27.0 no clasifica correctamente DeepStream como un backend de GPU y omite la aplicación de límites de píxeles en su ruta de decodificación. Atacantes no autenticados pueden activar DeepStream al momento de la solicitud para inicializar el grupo de decodificación de GPU a nivel de proceso y enviar video que elude los controles de recursos, causando denegación de servicio parcial para solicitudes concurrentes.
Information

Published : 2026-08-25 12:16

Updated : 2026-09-29 12:52

NVD link : CVE-2026-78684

Mitre link : CVE-2026-78684

CVE.ORG link : CVE-2026-78684

JSON object : View

Products Affected

vllm

  • vllm
CWE
CWE-400

Uncontrolled Resource Consumption