Heap Overflow Vulnerability in vLLM Affects API Functionality
CVE-2026-109311

7.1HIGH

Key Information:

Vendor

Vllm-project

Status
Vllm
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109311?

A heap overflow vulnerability in vLLM prior to version 0.29.0 can be exploited by authenticated remote attackers. These attackers can upload malicious IAMF containers to the audio transcription API endpoint, potentially leading to the corruption of the heap and crashing the API process. This is primarily due to inadequate validation during audio file processing, allowing attackers to bypass protections through a simple file-size check.

Affected Version(s)

vllm 0 < 0.29.0

vllm 0.29.0

References

https://github.com/vllm-project/vllm/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/vllm-before-0.29.0-h...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

KernelClint
dhalf
jperezdealgaba
.