Out-of-Memory Vulnerability in vLLM for Audio Processing

CVE-2026-57173

What is CVE-2026-57173?

A vulnerability exists in vLLM, an inference engine for large language models, affecting audio processing capabilities. Prior to version 0.24.0, an unauthenticated client could manipulate the audio input handling for /v1/chat/completions. This occurs because the system fails to enforce limits on the audio decoding duration. Consequently, a small compressed audio input could be exploited to expand into an excessively large float32 PCM allocation, leading to an out-of-memory crash of the worker. This issue can be triggered by inline data URLs that bypass the VLLM_AUDIO_FETCH_TIMEOUT limit, putting deployments that serve audio-capable models at risk. The vulnerability is addressed in version 0.24.0.

References