Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-100648

vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decoding.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

vllm-project vllm

Default version status: unaffected

  • 0 to < 0.29.0affected
  • 0.29.0unaffected
pkg:pypi/vllm

References