Executive brief
vllm is a machine learning serving framework that powers AI chat endpoints compatible with OpenAI's API. The audio transcription feature in multimodal chat fails to enforce configured file size limits, allowing unauthenticated attackers to submit oversized audio files that consume excessive memory and CPU during processing. This can cause denial of service or degrade performance for legitimate users.
Technical details
The MediaConnector.fetch_audio function bypasses the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB environment variable check when processing audio in multimodal chat endpoints, whereas the separate speech-to-text path correctly enforces it. An unauthenticated network attacker can submit oversized audio via public chat endpoints without authentication, causing the server to materialize and decode the full compressed audio file before applying only the weaker decoded-duration and decoded-byte limits. The vulnerability requires network access to an exposed chat endpoint but no user interaction or privileges.
Affected products
- vllm-project vllm before 0.29.0
Timeline
- 2026-09-12: disclosed
- 2026-09-26: patched: vllm 0.29.0 and later