EUVD-2026-110023
GHSA-8397-8qf6-f2gm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vLLM chat/completions API
-
DeliverySubmit legal ~600s audio clip
-
ExploitEncoder materializes full attention matrices
-
ExecutionPer-layer matrices retained across 24 layers
-
PersistGPU memory exhausted, CUDA OOM
-
ImpactEngineCore crashes, full denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable only when vLLM (prior to 0.32.0) is actually serving microsoft/Phi-4-multimodal-instruct - or another model reusing this Phi-4 audio tower - with the audio encoder on the default eager-attention path (use_pt_scaled_dot_product_attention unset, so default False; the official HF config does not set it, and --trust-remote-code is the documented standard way to serve this model, so this matches default deployments). The attacker needs only to submit an audio clip within the default server limits VLLM_MAX_AUDIO_CLIP_FILESIZE_MB=25 and VLLM_MAX_AUDIO_DECODE_DURATION_S=600; a legal ~10-minute silent clip suffices, no crafted content. LIMITING FACTORS: deployments not serving this specific audio-capable model are entirely unaffected; on GPUs with large headroom (e.g. 80 GB) a single request may survive, though a few sequential max-length requests or normal following traffic still exhaust memory because the last request's matrices stay resident. If the deployment front-ends the API with authentication, an attacker must first be able to reach the endpoint, though default vLLM has no auth. |
| Impact | This is a genuine but moderate-priority availability issue, not a hair-on-fire emergency. The input CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly captures a network-reachable, low-complexity, availability-only flaw with no confidentiality or integrity impact. The GHSA advisory verified end-to-end crash behavior on the official vllm/vllm-openai:v0.31.0 image (one 19.2 MB silent 600 s WAV killing EngineCore in ~6 seconds), so the mechanism is confirmed by the project's own security advisory; however, there is no KEV listing, no EPSS score was supplied, and no standalone exploit-code reference is present - so this is 'no public exploit identified at time of analysis' even though the advisory describes the trigger in enough detail to reproduce. SIGNAL CONFLICT TO VERIFY: the input CVSS uses PR:L (authenticated) while the advisory text explicitly states 'any unauthenticated client that can reach the chat/completions API of a default deployment' can trigger it - because default vLLM deployments ship without authentication, PR:N is the more defensible metric and I assess it as such below; defenders should treat this as unauthenticated-reachable in default configs. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a deterministic single-model single-request DoS that requires no data compromise. Real priority exists for any shop actually serving Phi-4-multimodal-instruct (or a model reusing this audio tower), where a single legal request means trivial, repeatable full-engine DoS; for everyone else running vLLM without that audio model, exposure is effectively nil. |
| Exploit ScenarioDerived | An attacker who can reach the chat/completions API of a default vLLM deployment serving microsoft/Phi-4-multimodal-instruct submits one legal ~10-minute audio clip (even silent noise, under the 25 MB / 600 s server limits). The eager-attention path materializes and retains ~120 per-layer [120×16×500×500] attention matrices across 24 encoder layers, exhausting GPU memory mid-forward and crashing EngineCore with CUDA out-of-memory, taking the whole server down (~6 seconds) for all users until a process restart. No public exploit code is referenced, but the GHSA advisory documents a verified reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Denial of service in vLLM prior to 0.32.0 lets a remote client terminate the entire inference engine by submitting a single legal audio clip - a roughly 10-minute silent recording is enough, no crafted content required. When the server hosts microsoft/Phi-4-multimodal-instruct (or another model reusing its audio tower), the Phi-4 conformer encoder runs attention in eager mode by default, materializes a full attention probability matrix per layer for every 500-frame chunk, and retains it on the module, so GPU memory climbs monotonically within one request until a CUDA out-of-memory error kills EngineCore for all users; the advisory reports worker death in about six seconds and the API then returns EngineDeadError. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the authoritative assessment rates this a genuine but moderate-priority availability issue, rated high on availability only (C:N/I:N/A:H) and unauthenticated where the API is exposed, while deployments not serving this audio-capable model are unaffected.
RemediationAI
Vendor-released patch: 0.32.0 - upgrade vLLM to 0.32.0 or later, which removes the self.attn retention in phi4mm_utils.py, defaults use_pt_scaled_dot_product_attention to True in both phi4mm_audio.py and phi4mm_utils.py, and adds regression tests (PR 60614, commit 3d52578e13454de0bb8352cac988347cdcc89928; advisory https://github.com/vllm-project/vllm/security/advisories/GHSA-8397-8qf6-f2gm). Until the upgrade can be staged, the practical compensating control is to shrink the encoder input by lowering VLLM_MAX_AUDIO_DECODE_DURATION_S and VLLM_MAX_AUDIO_CLIP_FILESIZE_MB well below their 600 s / 25 MB defaults, which cuts n_chunks and therefore the per-layer attention allocation (a 60 s cap yields roughly a twelfth of the chunks of a maximal clip); the trade-off is that legitimate longer audio is rejected, and the reduction is proportional rather than eliminating, so a small-headroom GPU can still be pushed over the edge by repeated requests because the last request's matrices remain resident. On GPUs with large headroom (e.g. 80 GB at default utilization) a single request may survive, but sequential max-length requests or normal following traffic still exhaust memory, so capacity is not a substitute for the patch. Because default vLLM has no authentication, restricting network reachability to the chat/completions API or fronting it with an authenticating proxy limits who can trigger the crash, but any client that can reach the endpoint can still kill the engine. Any of the code-level changes above breaks the chain; combining removal of the retained reference with the SDPA default is the recommended fix, and a crashed EngineCore requires a process restart.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is in vLLM's port of the Phi-4 multimodal speech encoder (vllm/model_executor/models/phi4mm_audio.py and phi4mm_utils.py), a conformer stack with 24 blocks, 16 attention heads and attention_dim 1024 that unfolds long audio into 500-frame chunks (max_seq_len = 500). MultiHeadedAttention.forward_attention in eager mode computes masked_softmax over the scores and unconditionally assigns the result to self.attn, a leftover torch.jit.Attribute inference/debug hook that serves no purpose in serving but pins the full [batch·chunks, heads, T, T] tensor past the layer's forward pass and past the request's lifetime. The scaled-dot-product-attention branch never materializes that matrix, but the official HF config for microsoft/Phi-4-multimodal-instruct does not set use_pt_scaled_dot_product_attention and the code default was False, so default deployments take the eager path. Audio length is bounded only by VLLM_MAX_AUDIO_CLIP_FILESIZE_MB=25 and VLLM_MAX_AUDIO_DECODE_DURATION_S=600, so a maximal 600 s clip yields ~120 chunks and per-layer tensors of roughly 1.8-2.29 GiB, exhausting the headroom left by --gpu-memory-utilization 0.9 on a 24 GB card mid-forward; a secondary effect is that the last request's matrices stay resident until overwritten by the next audio request. This is CWE-770 (Allocation of Resources Without Limits or Throttling) rather than a memory-safety bug: the trigger is a perfectly legal input length combined with an unbounded per-layer allocation and an unnecessary retained reference. The upstream fix (PR 60614) removes the self.attn assignment, flips the SDPA default to True in both modules, and adds regression tests asserting the probability matrix is not retained and that SDPA is the default.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Default vLLM deployments have no authentication and the advisory confirms unauthenticated reach, so PR:N (not the input's PR:L); deterministic single request gives AC:L; availability-only impact so C:N/I:N/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forward_attention to materialize and retain full attention matrices in self.attn. The scaled dot-product attention branch does not materialize these matrices. The resulting quadratic GPU-memory use can cause an out-of-memory condition and terminate EngineCore for all users. This issue is fixed in version 0.32.0.
Blast Radius
ecosystem impact- 94 pypi packages depend on vllm (94 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.32.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB