GPU VulnDB

Database/AI/ML frameworks & serving

vLLM: DeepStream backend misclassification skips pixel limits and lets unauthenticated video exhaust GPU decode

CVE-2026-78684AI/ML frameworks & servingcurated

Impact

vLLM before 0.27.0 does not classify DeepStream as a GPU backend, so the pixel-limit checks that normally cap multimodal input are skipped on that path. An unauthenticated caller can select DeepStream at request time, which initializes the process-wide GPU decode pool, then submit video that ignores the resource controls. The result is partial denial of service for every other request sharing that vLLM process - on a GPU node this is the whole model replica, not just the abusive session. Where an inference endpoint is exposed without an auth proxy, one caller can degrade a serving tier that other tenants pay for.

Who can reach it

Anyone who can send a request to the vLLM HTTP endpoint. No authentication is required, so any network path that reaches the inference port - a shared ingress, an internal service mesh route, or an unauthenticated endpoint - is enough.

What to do

Upgrade vLLM to 0.27.0 or later and restart each serving process; the fix is in commit e23b19309b8705b21c3b3ff4129c9974ba15a419. Cost is a rolling restart of model replicas, which means reloading weights onto the GPUs - no node drain or reboot needed. Until then, keep the endpoint behind authentication and avoid exposing the DeepStream backend to untrusted callers.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-78684https://github.com/vllm-project/vllm/security/advisories/GHSA-cqm8-jxg6-fqfqhttps://github.com/vllm-project/vllm/commit/e23b19309b8705b21c3b3ff4129c9974ba15a419https://www.vulncheck.com/advisories/vllm-before-denial-of-service-via-deepstream-backend

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.