{"id":"CVE-2026-116175","kind":"vulnerability","aliases":["CVE-2026-116175"],"related":[],"title":"vLLM: small compressed audio expands into memory-exhausting decoded PCM","description":"vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio via input_audio or audio_url in /v1/chat/completions requests that expands to huge decoded PCM, exhausting server memory.","summary":"vLLM from 0.19.0 before 0.24.0 passes audio from input_audio or audio_url in chat completion requests to load_audio without the max_duration_s decoded-duration limit. An authenticated attacker can send a small compressed audio file that decodes to a huge PCM stream and exhaust server memory.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-inference","ai-tooling","python","self-hosted","vllm"],"not_affected_if":["auth-required","internal-only","text-only-models"],"how_to_check":"- Check the installed version with `pip show vllm` and treat anything from `0.19.0` up to but not including `0.24.0` as exposed.\n- Check whether the server accepts audio in chat completions by looking for audio multimodal input enabled on `/v1/chat/completions`.","fix":"- Upgrade vLLM to `0.24.0` or later.\n- Until upgraded, restrict who can reach `/v1/chat/completions` and put a request size or memory limit in front of the server.","status":"open","published_at":"2026-10-25T14:16:57+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:36+00:00","updated_at":"2026-10-25T14:42:36+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T14:42:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vLLM to `0.24.0` or later.\n- Until upgraded, restrict who can reach `/v1/chat/completions` and put a request size or memory limit in front of the server.","reach":"internet","title":"vLLM: small compressed audio expands into memory-exhausting decoded PCM","impact":"medium","summary":"vLLM from 0.19.0 before 0.24.0 passes audio from input_audio or audio_url in chat completion requests to load_audio without the max_duration_s decoded-duration limit. An authenticated attacker can send a small compressed audio file that decodes to a huge PCM stream and exhaust server memory.","category":"ai-tooling","nicknames":[],"who_cares":["vllm","python","self-hosted","ai-inference"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated attacker exhausts server memory, causing denial of service","analyst_note":"Confirm the fixed version and whether audio input is on by default at https://nvd.nist.gov/vuln/detail/CVE-2026-116175 and the vLLM release notes.","how_to_check":"- Check the installed version with `pip show vllm` and treat anything from `0.19.0` up to but not including `0.24.0` as exposed.\n- Check whether the server accepts audio in chat completions by looking for audio multimodal input enabled on `/v1/chat/completions`.","needs_analyst":true,"not_affected_if":["text-only-models","auth-required","internal-only"],"who_is_affected":"Deployments of vLLM from 0.19.0 before 0.24.0 that accept audio through input_audio or audio_url in the OpenAI-compatible chat endpoint are exposed. The attacker must hold valid credentials for the server. Deployments that run text or image models only, or that are not reachable by untrusted users, can deprioritise this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":3360,"output_tokens":676,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116175':14A,17A '-2026':13A,16A '/v1/chat/completions':120C '0.19.0':31B,81C '0.24.0':33B,83C 'ai':19B,22B 'ai-infer':18B 'ai-tool':21B 'attack':60B,107C 'audio':4A,35B,38B,40B,48B,66B,96C,112C,115C,117C 'audiomediaio':91C 'authent':59B,106C 'bomb':87C 'call':94C 'chat':43B 'complet':44B 'compress':3A,65B,111C 'contain':84C 'cve':12A,15A 'decod':10A,55B,69B,103C,126C 'decoded-dur':54B,102C 'decompress':86C 'durat':52B,56B,100C,104C 'exhaust':9A,76B,128C 'expand':5A,123C 'file':67B 'host':27B 'huge':72B,125C 'infer':20B 'input':37B,114C 'limit':57B,105C 'load':47B,95C 'max':51B,99C 'memori':8A,78B,130C 'memory-exhaust':7A 'multimod':92C 'pass':34B 'path':93C 'pcm':11A,73B,127C 'python':24B 'request':45B,121C 'self':26B 'self-host':25B 'send':62B,109C 'server':77B,129C 'small':2A,64B,110C 'stream':74B 'tool':23B 'url':41B,118C 'via':113C 'vllm':1A,28B,29B,79C 'vulner':88C 'without':49B,97C","nicknames":[],"mitigations":[],"who_affected":"Deployments of vLLM from 0.19.0 before 0.24.0 that accept audio through input_audio or audio_url in the OpenAI-compatible chat endpoint are exposed. The attacker must hold valid credentials for the server. Deployments that run text or image models only, or that are not reachable by untrusted users, can deprioritise this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116175","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116175","severity":null,"published_at":"2026-10-25T14:16:57+00:00","modified_at":"2026-10-25T14:16:57+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}