Executive brief
vLLM is a large language model inference engine that processes various types of media (audio, video, images) submitted by users. The vulnerability causes the server to download and process entire remote or inline media files before checking size limits, allowing attackers to exhaust server memory and bandwidth by sending oversized media requests. Authentication is required for most attack vectors, but an unauthenticated endpoint is also vulnerable.
Technical details
The vulnerability exists across four ingress paths (shared HTTP fetch layer, chat completions audio endpoint, batch speech runner, and Rust frontend tokenize route) where media is fully materialized before documented size and count limits (VLLM_MAX_AUDIO_CLIP_FILESIZE_MB, --limit-mm-per-prompt) are enforced. HTTPConnection.get_bytes() and async_get_bytes() return entire response bodies without byte ceilings, enabling attackers to cause pre-inference memory allocation and outbound bandwidth consumption. Chat/batch endpoints require API keys when configured; the /tokenize route is unauthenticated.
Affected products
- vLLM Project vLLM through 0.29.0
Timeline
- 2026-09-26: disclosed