Memory Allocation Vulnerability in vLLM Inference Engine

CVE-2026-55646

What is CVE-2026-55646?

A memory allocation issue exists within the vLLM inference and serving engine for large language models, affecting versions 0.22.0 to 0.23.0. The vulnerabilities lie in the /v1/audio/transcriptions and /v1/audio/translations endpoints, where the engine reads the entire uploaded audio file into memory before validating its size against the documented maximum upload limit. This flaw allows an API caller to submit excessively large audio files, leading to significant memory usage and potential process termination due to resource constraints. The vulnerability has been corrected in version 0.24.0, emphasizing the importance of robust API size validations.

References