vLLM CVE-2026-116175

Requires an audio-capable (multimodal) vLLM deployment in the 0.19.0-0.23.x range that accepts audio content parts on /v1/chat/completions, and an attacker able to submit chat completion requests. The specific trigger is an input_audio data URL or an audio_url that routes through MediaConnector.fetch_audio() to AudioMediaIO.load_bytes()/load_file(), which call load_audio(..., sr=None) without passing max_duration_s. Limiting factors: by default API-key authentication is required (hence PR:L); the audio model/path must be enabled; and --allowed-media-domains, media fetch timeouts, and HTTP body limits constrain some audio_url delivery options but do NOT enforce a decoded-PCM duration/sample budget, so input_audio payloads fitting normal request size limits remain exploitable. If chat completions are exposed without authentication, the condition collapses to unauthenticated reachability (PR:N).

This is a medium-severity, availability-only denial-of-service issue (CWE-409 data amplification), and the signals are internally consistent rather than conflicting. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the GHSA-provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) agree: network-reachable, low attack complexity, low privileges required (an authenticated API caller), no user interaction, impacting availability only (VA:H / A:H) with no confidentiality or integrity effect. It is NOT in CISA KEV and there is no public exploit identified at time of analysis - no PoC or exploit-code reference is present in the input (only vendor/VulnCheck advisories). No EPSS score was provided, so statistical exploitation probability cannot be cited; its absence is not evidence of low risk. No SSVC fields were supplied; the only priority signal is the vuln.today Decision label 'this_week', consistent with a real but non-emergency DoS. The PR:L baseline is explicitly a policy choice tied to API-key auth: the advisory states that a deployment exposing chat completions WITHOUT authentication should be assessed at PR:N, which would raise real-world risk. Net: a genuine availability risk worth patching on a near-term schedule, not a confidentiality/RCE emergency; priority rises sharply for unauthenticated-exposed, audio-capable deployments.

An authenticated user of an audio-capable vLLM deployment sends a /v1/chat/completions request containing a small, highly compressed audio payload via input_audio (or an audio_url) that decodes to an enormous PCM buffer. Because AudioMediaIO calls load_audio without the max_duration_s guard, the decoder accumulates the oversized decoded frames before any model-level clip limit applies, exhausting server memory and degrading or denying availability. No public exploit code is identified at time of analysis, though the mechanism is fully described in the vendor advisory.