CVE-2026-78684— vLLM before 0.27.0 Denial of Service via DeepStream Backend

Quick assessment

Copy summary Copy citation

Affected

vllm-project vllm

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 vLLM 0.27.0 之前的版本中，未能正确将 DeepStream 识别为 GPU 后端，并且在其解码路径中缺少像素数量限制的执行机制。未经验证的攻击者可以在请求期间激活 DeepStream，以初始化进程级 GPU 解码池，并绕过资源控制提交视频，从而导致并发请求的部分服务不可用（拒绝服务）。

CVE-2026-78684 affects vllm-project vllm. No confirmed in-the-wild exploitation; assess based on exposure. 在 vLLM 0.27.0 之前的版本中，未能正确将 DeepStream 识别为 GPU 后端，并且在其解码路径中缺少像素数量限制的执行机制。未经验证的攻击者可以在请求期间激活 DeepStream，以初始化进程级 GPU 解码池，并绕过资源控制提交视频，从而导致并发请求的部分服务不可用（拒绝服务）。 CVE-2026-78684 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-78684

I. Basic Information for CVE-2026-78684

Affected Products

II. Public POCs for CVE-2026-78684

III. Intelligence Information for CVE-2026-78684

Vendor Advisories for CVE-2026-78684 (1)

• 🔗 vLLM before 0.27.0 Denial of Service via DeepStream Backend | Advisories | VulnCheck Read full article third-party-advisory

Exploits & Public PoCs for CVE-2026-78684 (1)

• 🔗 vLLM Unauthenticated Requests Exploit DeepStream Backend Confusion for DoS · Advisory · vllm-project/vllm · GitHub Read full article vendor-advisory

• https://www.cve.org/CVERecord?id=CVE-2026-78684

IV. Related Vulnerabilities

V. Comments for CVE-2026-78684