vLLM: DeepStream backend misclassification skips pixel limits and lets unauthenticated video exhaust GPU decode

Impact

vLLM before 0.27.0 does not classify DeepStream as a GPU backend, so the pixel-limit checks that normally cap multimodal input are skipped on that path. An unauthenticated caller can select DeepStream at request time, which initializes the process-wide GPU decode pool, then submit video that ignores the resource controls. The result is partial denial of service for every other request sharing that vLLM process - on a GPU node this is the whole model replica, not just the abusive session. Where an inference endpoint is exposed without an auth proxy, one caller can degrade a serving tier that other tenants pay for.

Who can reach it

Anyone who can send a request to the vLLM HTTP endpoint. No authentication is required, so any network path that reaches the inference port - a shared ingress, an internal service mesh route, or an unauthenticated endpoint - is enough.

What to do

Upgrade vLLM to 0.27.0 or later and restart each serving process; the fix is in commit e23b19309b8705b21c3b3ff4129c9974ba15a419. Cost is a rolling restart of model replicas, which means reloading weights onto the GPUs - no node drain or reboot needed. Until then, keep the endpoint behind authentication and avoid exposing the DeepStream backend to untrusted callers.

References

Related entries

• llama.cpp RPC server: crafted tensor dimensions hit a reachable assertion and abort the processCVE-2026-86317 · llama.cpp RPC server (rpc_server::deserialize_tensor in ggml/src/ggml-rpc/ggml-rpc.cpp)Medium
• vLLM: audio extracted from video input ignores decode size and duration limitsCVE-2026-90554 · vLLM (NanoNemotronVL audio-from-video extraction, _extract_audio_from_videos)Medium
• vLLM: unvalidated MoRIIO ack fields let a remote client exhaust resources on a serving nodeCVE-2026-92220 · vLLM MoRIIO KV-transfer connector (acknowledgement handler)Medium
• vLLM: rejected prefill requests leak Mooncake transfer placeholders, stalling valid requestsCVE-2026-94625 · vLLM MooncakeConnector (KV transfer placeholder reclamation)Medium
• JupyterLab: language-pack Plural-Forms header reaches new Function, executing code in the session originCVE-2026-102830 · JupyterLab / JupyterLite (translation catalogue Plural-Forms parser)Medium
• ONNX: symlink-following external-data write lets a local attacker append to victim-writable filesCVE-2026-49114 · ONNX Python library (save_external_data external-data path handling)Medium