CVE-2026-78684: Uncontrolled Resource Consumption in vllm-project vllm

The vulnerability in vLLM prior to version 0.27.0 involves improper classification of DeepStream as a GPU backend, which results in the failure to enforce pixel limits during video decoding. An unauthenticated attacker can exploit this by activating DeepStream at request time, which initializes a process-wide GPU decode pool. This allows the attacker to submit video data that bypasses resource controls, leading to uncontrolled resource consumption and causing partial denial of service for other concurrent requests.

The impact is a partial denial of service condition affecting concurrent requests due to uncontrolled GPU resource consumption. This can degrade service availability and performance but does not require authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Until a patch is available, monitoring for unusual GPU resource usage and restricting access to the affected service may help reduce risk.