Executive brief
vLLM is an open-source API server for running large language and speech models. When configured with audio transcription capabilities, it fails to properly validate audio sample rate headers, allowing authenticated users to crash the entire API server with a small malicious audio file. This causes a denial of service affecting all customers relying on that vLLM instance.
Technical details
The vulnerability exists in vLLM's transcription endpoint (/v1/audio/transcriptions) audio decoding logic. The code validates audio duration by reading sample rate and frame count directly from untrusted FLAC container headers without verifying header integrity, then uses these values to compute a duration guard (frames / sample_rate). An authenticated attacker can submit a malicious FLAC file with forged headers specifying an extremely high sample rate (e.g., 655350 Hz) in a small file, causing the duration check to pass while the actual decode operation allocates gigabytes of memory based on the header values. The vulnerability only manifests on the primary soundfile/libsndfile code path; the PyAV fallback correctly counts decoded samples. Preconditions include: valid API credentials, a transcription-capable model deployed, the vllm[audio] extra installed, and no upstream proxy with body size limits. An authenticated attacker can repeatedly crash the shared API server process with requests as small as 3.2 MiB, causing service-wide denial of service across all API clients. A fix is available in version 0.28.0 and later.
Affected products
- vLLM Project vLLM before 0.28.0
Timeline
- 2026-08-28: disclosed: GitHub Security Advisory GHSA-99f2-hwrc-gvq8 published
- 2026-09-12: patched: Fixed in vLLM 0.28.0