CVE-2026-78684
Received Received - Intake

vLLM DeepStream GPU Decode Resource Bypass

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causing partial denial of service for concurrent requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-78684
EUVD
EUVD-2026-65457

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nvidia deepstream *
vllm vllm to 0.27.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

vLLM before version 0.27.0 fails to recognize DeepStream as a GPU backend and does not enforce pixel limits during video decoding. This allows unauthenticated attackers to activate DeepStream at request time, initializing a process-wide GPU decode pool and submitting videos that bypass resource controls. This causes partial denial of service for concurrent requests by consuming excessive GPU resources.

Detection Guidance

Check vLLM version with 'pip show vllm' or 'vllm --version'. If version is below 0.27.0, the system is vulnerable. Monitor GPU resource usage for unexpected spikes during video processing tasks.

Impact Analysis

This vulnerability can lead to partial denial of service for concurrent requests, causing timeouts or degraded performance. Attackers can consume GPU resources by submitting specially crafted videos, reducing availability for other users. Systems relying on vLLM for video processing may experience reduced throughput or increased latency.

Compliance Impact

This vulnerability primarily causes partial denial of service by allowing unauthorized GPU resource consumption, which could impact availability of services. It does not directly affect confidentiality or integrity of data, so direct impacts on GDPR or HIPAA compliance are limited. However, service disruptions could indirectly affect compliance with availability requirements in these regulations.

Mitigation Strategies

Upgrade vLLM to version 0.27.0 or later immediately. Disable DeepStream backend if not required. Restrict GPU access permissions and enforce resource limits.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78684. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart