CVE-2026-78684: vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decod

vLLM (a software framework for running large language models) before version 0.27.0 has a vulnerability where it fails to properly identify DeepStream as a GPU backend and doesn't enforce pixel limits when decoding video. Unauthenticated attackers can exploit this by activating DeepStream to submit videos that bypass resource controls, causing a partial denial of service (where some users experience service disruption) for other concurrent requests.