CyberRota Analysis
AI-GeneratedvLLM versions prior to 0.27.0 are vulnerable due to improper classification of DeepStream as a GPU backend, which leads to a lack of pixel-limit enforcement in the decoding process. This flaw allows unauthenticated attackers to exploit the system by initializing the GPU decode pool and submitting video that can overwhelm resources, potentially causing partial denial of service for legitimate requests. Organizations using vLLM should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causing partial denial of service for concurrent requests.