CVE-2026-78684

vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causing partial denial of service for concurrent requests.

• CWE-400

• https://github.com/vllm-project/vllm/commit/e23b19309b8705b21c3b3ff4129c9974ba15a419Patch
• https://github.com/vllm-project/vllm/security/advisories/GHSA-cqm8-jxg6-fqfqVendor Advisory
• https://www.vulncheck.com/advisories/vllm-before-denial-of-service-via-deepstream-backendThird Party Advisory

Published

Aug 25, 2026

Last Modified

Sep 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78679GitPython before 3.1.59 contains an arbitrary file read vuln…6.5
• CVE-2026-7868IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 throu…8.8
• CVE-2026-78680NLTK versions before 3.10.3 fail to use validated absolute p…7.8
• CVE-2026-78681NLTK versions before 3.10.3 use xml.etree.ElementTree to par…7.5
• CVE-2026-78682NLTK before 3.10.3 contains a server-side request forgery vu…7.5
• CVE-2026-78683NLTK before 3.10.0 (affected versions <=3.9.4) contains an u…9.6
• CVE-2026-78685Medical Practice Management System developed by Le-yan has a…8.8
• CVE-2026-78689Description NGINX JavaScript (njs) has a vulnerability in …8.1
• CVE-2026-7869IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path …5.4
• CVE-2026-78691Improper Neutralization of Special Elements in Data Query Lo…2.1
• CVE-2026-78693Generation of Error Message Containing Sensitive Information…6.9
• CVE-2026-78699Unchecked Return Value vulnerability in ash-project ash_post…7.2