vLLM CVE-2026-114052

The target vLLM instance (version after 0.24.0 and before 0.31.0) must be serving the MOSS-Audio model and expose the HTTP /tokenize endpoint to the attacker. The attacker supplies distinct or oversized mel_config values via request-controlled mm_processor_kwargs, each of which is cached in an unbounded per-processor dictionary. Critically, no authentication limits this attack: the description states the /tokenize endpoint bypasses --api-key, so even deployments configured with an API key are exploitable. The main limiting factors are network reachability of the API and whether the MOSS-Audio model is actually deployed; versions at or above 0.31.0, or deployments not serving this model, are not affected.

This is a credible availability-focused priority for anyone running the affected feature, though not a universal emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction, and the impact is confined to availability (VA:H; VC:N/VI:N/VA:H) - consistent with CWE-770 unbounded resource allocation and with the description's host-memory-exhaustion/process-crash outcome. The score of 8.7 is driven entirely by ease of access plus high availability impact, with zero confidentiality or integrity impact, so this is a classic DoS rather than a code-execution or data-exposure flaw. A critical aggravating factor explicitly stated in the description is that the vulnerable /tokenize endpoint BYPASSES the --api-key control, meaning deployments that believe they are authentication-gated are in fact exposed - this raises real-world risk above what the raw vector alone conveys. No EPSS score, KEV listing, or POC is present in the provided data, so there is no evidence of active exploitation or public exploit code; the likelihood signals are therefore unknown rather than confirmed-low. Net: treat as a genuine patch-worthy DoS for exposed vLLM instances serving the MOSS-Audio model, but it is not an RCE and its practical blast radius depends on whether that specific model/endpoint is reachable.

An attacker who can reach a vLLM server's HTTP API serving the MOSS-Audio model sends repeated requests to the /tokenize endpoint, each carrying a distinct or oversized mel_config value inside mm_processor_kwargs. Because this endpoint is not protected by --api-key, no credentials are needed; each unique value causes a new processor to be cached in an unbounded dictionary, steadily consuming host memory until the API process is exhausted and crashes. No public exploit code is identified at time of analysis, but the attack requires only crafted HTTP requests and no special tooling.