Vulnerability Details CVE-2026-78684
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causing partial denial of service for concurrent requests.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 45.0%
CVSS Severity
CVSS v3 Score 5.3
Products affected by CVE-2026-78684
-
cpe:2.3:a:vllm:vllm:0.1.0
-
cpe:2.3:a:vllm:vllm:0.1.1
-
cpe:2.3:a:vllm:vllm:0.1.2
-
cpe:2.3:a:vllm:vllm:0.1.3
-
cpe:2.3:a:vllm:vllm:0.1.4
-
cpe:2.3:a:vllm:vllm:0.1.5
-
cpe:2.3:a:vllm:vllm:0.1.6
-
cpe:2.3:a:vllm:vllm:0.1.7
-
cpe:2.3:a:vllm:vllm:0.10.0
-
cpe:2.3:a:vllm:vllm:0.10.1
-
cpe:2.3:a:vllm:vllm:0.10.1.1
-
cpe:2.3:a:vllm:vllm:0.10.2
-
cpe:2.3:a:vllm:vllm:0.11.0
-
cpe:2.3:a:vllm:vllm:0.11.1
-
cpe:2.3:a:vllm:vllm:0.11.2
-
cpe:2.3:a:vllm:vllm:0.12.0
-
cpe:2.3:a:vllm:vllm:0.13.0
-
cpe:2.3:a:vllm:vllm:0.14.0
-
cpe:2.3:a:vllm:vllm:0.14.1
-
cpe:2.3:a:vllm:vllm:0.15.0
-
cpe:2.3:a:vllm:vllm:0.15.1
-
cpe:2.3:a:vllm:vllm:0.15.2
-
cpe:2.3:a:vllm:vllm:0.16.0
-
cpe:2.3:a:vllm:vllm:0.16.1
-
cpe:2.3:a:vllm:vllm:0.17.0
-
cpe:2.3:a:vllm:vllm:0.17.1
-
cpe:2.3:a:vllm:vllm:0.17.2
-
cpe:2.3:a:vllm:vllm:0.18.0
-
cpe:2.3:a:vllm:vllm:0.18.1
-
cpe:2.3:a:vllm:vllm:0.18.2
-
cpe:2.3:a:vllm:vllm:0.19.0
-
cpe:2.3:a:vllm:vllm:0.19.1
-
cpe:2.3:a:vllm:vllm:0.19.2
-
cpe:2.3:a:vllm:vllm:0.2.0
-
cpe:2.3:a:vllm:vllm:0.2.1
-
cpe:2.3:a:vllm:vllm:0.2.2
-
cpe:2.3:a:vllm:vllm:0.2.3
-
cpe:2.3:a:vllm:vllm:0.2.4
-
cpe:2.3:a:vllm:vllm:0.2.5
-
cpe:2.3:a:vllm:vllm:0.2.6
-
cpe:2.3:a:vllm:vllm:0.2.7
-
cpe:2.3:a:vllm:vllm:0.20.0
-
cpe:2.3:a:vllm:vllm:0.20.1
-
cpe:2.3:a:vllm:vllm:0.20.2
-
cpe:2.3:a:vllm:vllm:0.21.0
-
cpe:2.3:a:vllm:vllm:0.21.1
-
cpe:2.3:a:vllm:vllm:0.22.0
-
cpe:2.3:a:vllm:vllm:0.22.1
-
cpe:2.3:a:vllm:vllm:0.23.0
-
cpe:2.3:a:vllm:vllm:0.23.1
-
cpe:2.3:a:vllm:vllm:0.24.0
-
cpe:2.3:a:vllm:vllm:0.25.0
-
cpe:2.3:a:vllm:vllm:0.25.1
-
cpe:2.3:a:vllm:vllm:0.26.0
-
cpe:2.3:a:vllm:vllm:0.26.1
-
cpe:2.3:a:vllm:vllm:0.3.0
-
cpe:2.3:a:vllm:vllm:0.3.1
-
cpe:2.3:a:vllm:vllm:0.3.2
-
cpe:2.3:a:vllm:vllm:0.3.3
-
cpe:2.3:a:vllm:vllm:0.4.0
-
cpe:2.3:a:vllm:vllm:0.4.1
-
cpe:2.3:a:vllm:vllm:0.4.2
-
cpe:2.3:a:vllm:vllm:0.4.3
-
cpe:2.3:a:vllm:vllm:0.5.0
-
cpe:2.3:a:vllm:vllm:0.5.1
-
cpe:2.3:a:vllm:vllm:0.5.2
-
cpe:2.3:a:vllm:vllm:0.5.3
-
cpe:2.3:a:vllm:vllm:0.5.4
-
cpe:2.3:a:vllm:vllm:0.5.5
-
cpe:2.3:a:vllm:vllm:0.6.0
-
cpe:2.3:a:vllm:vllm:0.6.1
-
cpe:2.3:a:vllm:vllm:0.6.2
-
cpe:2.3:a:vllm:vllm:0.6.3
-
cpe:2.3:a:vllm:vllm:0.6.4
-
cpe:2.3:a:vllm:vllm:0.6.5
-
cpe:2.3:a:vllm:vllm:0.6.6
-
cpe:2.3:a:vllm:vllm:0.7.0
-
cpe:2.3:a:vllm:vllm:0.7.1
-
cpe:2.3:a:vllm:vllm:0.7.2
-
cpe:2.3:a:vllm:vllm:0.7.3
-
cpe:2.3:a:vllm:vllm:0.8.0
-
cpe:2.3:a:vllm:vllm:0.8.1
-
cpe:2.3:a:vllm:vllm:0.8.2
-
cpe:2.3:a:vllm:vllm:0.8.3
-
cpe:2.3:a:vllm:vllm:0.8.4
-
cpe:2.3:a:vllm:vllm:0.8.5
-
cpe:2.3:a:vllm:vllm:0.9.0
-
cpe:2.3:a:vllm:vllm:0.9.0.1
-
cpe:2.3:a:vllm:vllm:0.9.1
-
cpe:2.3:a:vllm:vllm:0.9.2