Sign in
Deutsch English Español Polski
Medium

vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

  • Disclosed: 16.09.2026
  • Updated: 11.10.2026 15:18

Summary

The audio decode-duration guard (max_duration_s, env VLLM_MAX_AUDIO_DECODE_DURATION_S, default 600s) that protects against audio decompression-bomb DoS is wired into only the speech-to-text path (/v1/audio/transcriptions). The chat audio path (/v1/chat/completions, input_audio content parts) calls the same decoder with no limit, so an unauthenticated client can submit a few-KB compressed audio file that expands to multiple GB of float32 PCM at decode time, OOM-killing the worker. This is a distinct sibling of CVE-2026-5497 (video frame-count bomb, VideoMediaIO.load_base64) and GHSA-pq5c-rjhq-qp7p (image) in the same media subsystem.

Verified against main at HEAD d78650c (2026-06-16); applicable to the latest release v0.23.0.

Details

The guard rejects long audio during decode (before allocation), implemented in vllm/multimodal/media/audio.py:

  • load_audio_pyav — metadata reject (~82-98) and live sample-count reject (~129-136)
  • load_audio_soundfile — frames reject (~165-174)

All are gated on if max_duration_s is not None.

It is passed in exactly one place — the transcription serving layer:

python
# .../speech_to_text/base/serving.py:~170-174
load_audio(buf, sr=..., max_duration_s=self.max_audio_decode_duration_s)
#   self.max_audio_decode_duration_s = envs.VLLM_MAX_AUDIO_DECODE_DURATION_S  (default 600)

The chat path never threads it:

python
# vllm/multimodal/media/audio.py:237-238
def load_bytes(self, data: bytes) -> tuple[npt.NDArray, float]:
    return load_audio(BytesIO(data), sr=None)   # no max_duration_s -> every guard above is skipped

Unauthenticated reachability chain (chat): parse_input_audio (chat_utils.py) -> parse_audio -> connector.fetch_audio -> AudioMediaIO._load_data_url -> load_base64 -> load_bytes -> load_audio(..., sr=None). The connector never passes max_duration_s, and inline data: URLs need no HTTP fetch (so VLLM_AUDIO_FETCH_TIMEOUT does not bound them). The OpenAI-compatible server has no auth by default (auth only when --api-key / VLLM_API_KEY is set).

Impact

Unauthenticated remote denial of service (availability) via memory amplification on a default-no-auth endpoint, on any deployment serving an audio-capable model. Same class and impact as the sibling CVE-2026-5497 (video). CWE-770 / CWE-409.

Fix

A fix was introduced in this MR: https://github.com/vllm-project/vllm/pull/45908

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) vllm < 0.24.0 0.24.0

References

CVSS score 6.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-770
Platform
Python (PyPI)
Package
vllm
Disclosed
16.09.2026
Updated
11.10.2026 15:18

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-4179 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-hcwq-8wjf-3gcr - CC BY 4.0

Vulnerability history: vllm

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (94) in the archive
Total entries
94
First → latest
09.2024 10.2026
Without a fix
5
Exploited in attacks
0

Severity breakdown

  • Critical 9
  • High 23
  • Medium 47
  • Low 4
  • Unrated 11

Disclosures per year

Severity:
  1. A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a man
    High · 7.5 CVE-2026-103241 < 0.27.0 0.27.0
  2. vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. A
    High · 7.5 CVE-2026-100652 >= 0.22.0, < 0.24.0 0.24.0
  3. vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions this entry
    Medium · 6.5 CVE-2026-57173 < 0.24.0 0.24.0
  4. vLLM has Remote DoS via Invalid Recovered Token Reinjection
    High · 7.5 CVE-2026-54234 >= 0.17.1, < 0.24.0 0.24.0
  5. vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends
    High · 7.5 CVE-2026-55574 < 0.24.0 0.24.0
  6. vLLM denial of service via prompt embeds on M-RoPE models
    High CVE-2026-55514 >= 0.12.0, < 0.24.0 0.24.0
  7. vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package.
    High · 8.8 CVE-2026-54232 < 0.22.1 0.22.1
  8. vLLM: OpenAI auth bypass
    Critical · 9.1 CVE-2026-48746 >= 0.3.0, < 0.22.0 0.22.0
  9. vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution
    High · 7.5 CVE-2026-41523 < 0.22.0 0.22.0
  10. vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processin
    High · 7.5 CVE-2026-5497 >= 0.8.0, < 0.19.0 0.19.0
  11. vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out
    High · 8.8 CVE-2026-27893 >= 0.10.1, < 0.18.0 0.18.0
  12. vLLM has RCE In Video Processing
    Critical · 9.8 CVE-2026-22778 >= 0.8.3, < 0.14.1 0.14.1
  13. vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector
    High · 7.1 CVE-2026-24779 < 0.14.1 0.14.1
  14. vLLM affected by RCE via auto_map dynamic module loading during model initialization
    High · 8.8 CVE-2026-22807 >= 0.10.1, < 0.14.0 0.14.0
  15. vLLM introduced enhanced protection for CVE-2025-62164
    High · 8.8 CVE-2026-56340 >= 0.10.2, < 0.13.0 0.13.0
  16. vLLM vulnerable to remote code execution via transformers_utils/get_config
    High · 7.1 CVE-2025-66448 < 0.11.1 0.11.1
  17. vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs
    High · 6.5 CVE-2025-62372 >= 0.5.5, < 0.11.1 0.11.1
  18. vLLM deserialization vulnerability leading to DoS and potential RCE
    High · 8.8 CVE-2025-62164 >= 0.10.2, < 0.11.1 0.11.1
  19. vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class
    High · 7.1 CVE-2025-6242 >= 0.5.0, < 0.11.0 0.11.0
  20. vLLM is vulnerable to timing attack at bearer auth
    High · 7.5 CVE-2025-59425 < 0.11.0 0.11.0
Show more (13) Showing 20 of 33

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.