Executive brief
vLLM is a popular open-source inference engine that accelerates large language and multimodal models. When serving NanoNemotronVL models with video processing enabled, the audio extraction feature lacks memory limits. An attacker can upload a small, highly-compressed video file that expands to gigabytes of memory during decoding, crashing the inference server and causing service outage.
Technical details
The vulnerability is an uncontrolled resource consumption flaw in the NanoNemotronVL video audio extraction code. The _extract_audio_from_videos function in nano_nemotron_vl.py calls load_audio_pyav() without enforcing the max_duration_s or max_decode_bytes parameters, bypassing the protections available in the direct audio upload path. An attacker with network access to a vLLM inference server configured with use_audio_in_video=True can supply a specially-crafted video as multimodal input, forcing gigabytes of memory allocation during audio decoding. This results in memory exhaustion and denial of service. The vulnerability affects vLLM versions 0.10.2 through 0.27.x and is fixed in 0.28.0.
Affected products
- vLLM vLLM >=0.10.2, <0.28.0
Timeline
- 2026-08-28: disclosed
- 2026-09-12: patched: Fixed in vLLM 0.28.0