Executive brief
vLLM is an engine used to serve and run large language models, including those that process audio. A vulnerability in its audio transcription feature allows an attacker to crash the server by uploading a specially crafted, highly compressed audio file. While the file size appears small during upload, it expands to a massive size during processing, exhausting the server's memory and causing a service outage.
Technical details
A denial-of-service (DoS) vulnerability exists in vLLM's speech-to-text processing due to improper handling of highly compressed data (CWE-409). The /v1/audio/transcriptions endpoint enforces a limit on the compressed upload size (default 25MB) but fails to validate the size of the decoded PCM output before memory allocation. An attacker can provide a 25MB OPUS file that expands to approximately 14.9GB of float32 PCM data during the decoding process. Because the duration check (max_audio_clip_s) occurs only after the full decode and contiguous memory allocation via np.concatenate, a small number of concurrent requests can trigger an Out-of-Memory (OOM) killer event. The issue is resolved in version 0.23.1rc0 by enforcing a decoded duration limit during the decoding loop.
Affected products
- vllm-project vLLM < 0.23.1rc0
Timeline
- 2026-06-09: other: Fix merged in pull request #44970
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD