Executive brief
vLLM is an open-source inference engine for large language models that supports video input processing. Attackers can exploit a flaw in how the DeepStream GPU video decoder is classified to bypass resource controls and trigger a partial denial of service affecting concurrent requests. By requesting GPU-accelerated video decoding that was not pre-configured at startup, an unauthenticated attacker can cause legitimate requests to time out and fail.
Technical details
The vulnerability stems from three root causes: (1) DeepStream is registered as an inner codec of OpenCV rather than as a standalone GPU backend, allowing backend_requires_gpu() to return False and requests to bypass GPU backend validation in VideoMediaIO.merge_kwargs(); (2) the DeepStream decode path calls probe_metadata() but omits the _check_frame_pixel_limit() validation check applied by other backends (OpenCV, PyAV, TorchCodec, PyNvVideoCodec), allowing oversized frames to be processed; and (3) DeepStream uses a process-wide singleton decode pool initialized on first request with user-controlled pool size, rather than at startup. An unauthenticated client can send a video inference request specifying backend="deepstream" to initialize the GPU decode pool and submit video that would be rejected by other backends, exhausting GPU resources and causing timeouts for concurrent requests. The fix requires registering DeepStream as a GPU-classified codec, enforcing pixel-limit checks, and making pool initialization startup-only.
Affected products
- vLLM vLLM before 0.27.0
Timeline
- 2026-08-25: disclosed
- 2026-08-11: patched: fix available in version 0.27.0 and later