Executive brief
vLLM is an open-source large language model serving framework used to run AI models in production. The audio processing feature in vLLM's chat endpoint fails to enforce resource limits on audio decompression, allowing an unauthenticated attacker to submit a small compressed audio file that expands to gigabytes of data in memory, causing the server to run out of memory and crash. This affects any deployment serving audio-capable models with default settings (which have no authentication enabled).
Technical details
The vulnerability is a resource exhaustion / decompression bomb attack (CWE-770, CWE-409) in the audio media handling subsystem of vLLM. The audio decoder has a `max_duration_s` guard that limits audio decode duration (default 600 seconds), but this guard is only applied to the `/v1/audio/transcriptions` speech-to-text endpoint. The `/v1/chat/completions` endpoint's audio path (`input_audio` content parts) calls `AudioMediaIO.load_bytes()` which invokes the decoder without passing the duration limit, causing all protections to be skipped. An attacker can send a few kilobytes of compressed audio that decompresses to multiple gigabytes of float32 PCM samples, consuming all available memory on the worker. The attack is unauthenticated because the OpenAI-compatible API server has no auth by default; inline `data:` URLs bypass HTTP fetch timeouts. The fix was merged in PR #45908 and released in version 0.24.0.
Affected products
- vLLM Project vLLM <= 0.23.0
Timeline
- 2026-08-23: disclosed: Initially published by vLLM maintainers
- 2026-09-16: advisory: Published to GitHub Advisory Database and NVD
- 2026-09-16: patched: Fix available in vLLM v0.24.0 via PR #45908