EUVD-2026-87742
GHSA-526f-298v-f597
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vLLM multimodal chat endpoint
-
DeliveryCraft oversized audio payload
-
ExploitSubmit via chat request
-
ExecutionSize check bypassed, audio decoded
-
ImpactMemory/CPU exhausted, service degraded
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a reachable vLLM instance (before 0.29.0) exposing the multimodal chat endpoint with audio input handling active - i.e., a deployment serving an audio-capable model or otherwise accepting audio clips in chat requests. Exploitation is unauthenticated (PR:N) and needs no user interaction, but its practical impact is limited by whether the chat endpoint is exposed without an authenticating reverse proxy, request-size limits, or rate limiting, and by the host's memory/CPU headroom; impact is availability-only (VA:L) with no data exposure or code execution. |
| Impact | This is a genuine but low-severity availability issue, not a high-CVSS-but-hollow finding. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L, score 6.9) is internally consistent with the description: network-reachable, low-complexity, unauthenticated (PR:N), and impact confined to a LOW availability effect (VA:L) with no confidentiality or integrity impact - appropriate for a resource-exhaustion bug that degrades rather than crashes. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis'; the risk is theoretical/opportunistic rather than actively exploited. The CVSS-4.0 base score of 6.9 (MEDIUM) somewhat overstates the practical danger of a single availability-only DoS whose worst case is transient memory/CPU consumption on one inference process - a mapped CVSS 3.1 with A:L lands nearer 5.3. There is no signal conflict: attack vector, complexity, and privilege metrics all agree with the unauthenticated-network DoS narrative. The main caveat is that real-world impact depends on whether the vLLM chat endpoint is exposed without an upstream authenticating proxy or rate limiter. |
| Exploit ScenarioDerived | An attacker with network reach to a vLLM server's multimodal chat endpoint submits a chat request referencing an oversized audio clip that exceeds VLLM_MAX_AUDIO_CLIP_FILESIZE_MB. Because the size limit is not enforced before decoding, the server allocates memory and burns CPU decoding the file; repeating this across concurrent requests degrades or exhausts the inference host's resources. No authentication is required and no public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Remote denial of service in vLLM versions before 0.29.0 allows unauthenticated clients to bypass the configured multimodal audio clip size limit (VLLM_MAX_AUDIO_CLIP_FILESIZE_MB) by submitting oversized audio through chat endpoints, causing excessive memory and CPU consumption during decoding. The CVSS vector confirms this is remotely reachable with no privileges (PR:N) and no user interaction, but impact is availability-only (VA:L) - there is no data exposure, integrity loss, or code execution. No public exploit code has been identified at time of analysis, and a vendor-released patch (0.29.0) is available, making this a genuine but low-severity resource-exhaustion issue rather than a high-impact breakout. Exploitability in practice depends on whether the audio-capable chat endpoint is exposed without an authenticating reverse proxy, request-size limits, or rate limiting, and on the host's memory/CPU headroom.
RemediationAI
The primary fix is to upgrade vLLM to 0.29.0 or later, the vendor-released patched version in which the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit is properly enforced in the audio decoding path; consult the vendor advisory at https://github.com/vllm-project/vllm/security/advisories/GHSA-jcq2-4gch-5qhf and the VulnCheck advisory at https://www.vulncheck.com/advisories/vllm-before-0.29.0-uncontrolled-resource-consumption-via-audio-decoding when planning the upgrade. Where an immediate upgrade is not possible, compensating controls should target the amplification path: if audio input is not a required feature, stop serving audio-capable models or reject/ignore audio content parts at the chat endpoint (side effect: loss of multimodal audio functionality for all users); front the vLLM API with a reverse proxy that enforces a strict maximum request body size and request timeout so oversized audio payloads are rejected before decoding (side effect: legitimate large requests, including benign audio or long context payloads, must be tuned to fit the new limit); require authentication at that proxy and apply per-client rate limiting to reduce the volume an unauthenticated attacker can drive (side effect: changes client integration and may throttle legitimate batch workloads); and run the inference process under cgroup memory and CPU quotas and monitor for OOM kills so a single oversized decode cannot exhaust the host (side effect: legitimate large jobs may be throttled or terminated, and crashes degrade availability for co-tenants). Note that these controls reduce blast radius but do not repair the underlying missing limit check, so the 0.29.0 upgrade remains the recommended resolution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vLLM is an open-source high-throughput inference and serving engine for large language models that exposes an OpenAI-compatible HTTP API, including a multimodal chat completions endpoint capable of accepting audio inputs. Audio clips received on that endpoint are decoded server-side by the model's audio processor before inference; the environment variable VLLM_MAX_AUDIO_CLIP_FILESIZE_MB is intended to cap the size of those clips. Per CWE-400 (Uncontrolled Resource Consumption), the enforcement of that limit is missing or incomplete in the audio decoding path in versions prior to 0.29.0, so an attacker-controlled oversized audio payload is decoded rather than rejected, and decoding operations on audio are allocation- and CPU-intensive. The affected product is captured by the CPE cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*, with EUVD listing affected versions as vLLM 0 up to (but not including) 0.29.0. This is a resource-limit enforcement failure, not a memory-safety bug: there is no buffer overflow, no deserialization gadget, and no path to code execution, which is consistent with the availability-only impact.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Unauthenticated low-complexity network request (PR:N/AC:L) triggering pre-check resource consumption with only partial/transient availability impact (A:L) and no confidentiality or integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decoding.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB