Live › vulnerability › CVE-2026-116175
Go to dashboardvLLM from 0.19.0 before 0.24.0 passes audio from input_audio or audio_url in chat completion requests to load_audio without the max_duration_s decoded-duration limit. An authenticated attacker can send a small compressed audio file that decodes to a huge PCM stream and exhaust server memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Deployments of vLLM from 0.19.0 before 0.24.0 that accept audio through input_audio or audio_url in the OpenAI-compatible chat endpoint are exposed. The attacker must hold valid credentials for the server. Deployments that run text or image models only, or that are not reachable by untrusted users, can deprioritise this.
No product ranges from the sources yet.
pip show vllm and treat anything from 0.19.0 up to but not including 0.24.0 as exposed./v1/chat/completions.0.24.0 or later./v1/chat/completions and put a request size or memory limit in front of the server.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio via input_audio or audio_url in /v1/chat/completions requests that expands to huge decoded PCM, exhausting server memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-116175")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.