CVE-2026-78684

5.3 Moyenne

Publiée le 25/08/2026 à 14:16 · Modifiée le 29/09/2026 à 14:52 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causing partial denial of service for concurrent requests.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.9 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.3 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

Faiblesses (CWE)

CWE-400

Références

https://github.com/vllm-project/vllm/commit/e23b19309b8705b21c3b3ff4129c9974ba15a419 Patch
https://github.com/vllm-project/vllm/security/advisories/GHSA-cqm8-jxg6-fqfq Vendor Advisory
https://www.vulncheck.com/advisories/vllm-before-denial-of-service-via-deepstream-backend Third Party Advisory

CVE-2026-78684

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs