CVE-2026-78684 vLLM before 0.27.0 Denial of Service via DeepStream Backend

vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...

CVE-2026-78684 vLLM before 0.27.0 Denial of Service via DeepStream Backend

vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...

CVE-2026-78684

vLLM versions prior to 0.27.0 are susceptible to a denial-of-service condition through improper handling of the DeepStream backend. The root cause is a failure to classify DeepStream as a GPU backend combined with missing pixel-limit enforcement in the decode path. An unauthenticated attacker can...

CVE-2026-78684 vLLM before 0.27.0 Denial of Service via DeepStream Backend

vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...

CVE-2026-78684: Uncontrolled Resource Consumption

vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...

PT-2026-81274

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.27.0 Description The software fails to properly classify DeepStream as a GPU backend, which leads to the omission of pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream during ...

deepstream is vulnerable to prototype pollution

Impact Prototype pollution in deepstream server v =10.0.4. Potential privilege escalation from any authenticated user with write permission to any record. Patches Yes, upgrade to v10.0.5 Workarounds Filter out all messages containing the path proto, constructor, prototype, before they reach the...

Prototype Pollution

Overview @deepstream/server is an a scalable server for realtime webapps Affected versions of this package are vulnerable to Prototype Pollution via the message processing pipeline. An attacker can escalate privileges and potentially gain unauthorized access or modify sensitive data by sending...

EUVD-2026-37943

deepstream is vulnerable to prototype pollution...

GHSA-9V98-6G37-X9G6 deepstream is vulnerable to prototype pollution

Impact Prototype pollution in deepstream server v =10.0.4. Potential privilege escalation from any authenticated user with write permission to any record. Patches Yes, upgrade to v10.0.5 Workarounds Filter out all messages containing the path proto, constructor, prototype, before they reach the...

CVE-2026-49252

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any...

CVE-2026-49252 deepstream is vulnerable to prototype pollution

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any...

CVE-2026-49252

CVE-2026-49252 affects the deepstream server. Versions prior to 10.0.5 are vulnerable to Prototype Pollution , with exploitation leading to potential privilege escalation by any authenticated user with write permission to any record. The issue is fixed in version 10.0.5 . Affected product: deepst...

CVE-2026-49252

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any...

CVE-2026-49252 deepstream is vulnerable to prototype pollution

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any...

CVE-2026-49252 deepstream is vulnerable to prototype pollution

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any...

PT-2026-50790

Name of the Vulnerable Software and Affected Versions deepstream versions prior to 10.0.5 Description A Prototype Pollution issue exists in the server, which allows clients and backend services to synchronize data, send messages, and make remote procedure calls RPCs at scale. Prototype Pollution...

CVE-2026-49252: Improperly Controlled Modification of Object Prototype Attributes

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any...