CVE-2026-57173

Katalog CVE

CVSS 6.5 · Medium EPSS 0,73%

Kerentanan Allocation of Resources Without Limits or Throttling pada vllm. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v1/chat/completions calls AudioMediaIO.load_bytes or AudioMediaIO.load_file without passing VLLM_MAX_AUDIO_DECODE_DURATION_S to the shared audio decoder. An unauthenticated client can therefore submit a small compressed audio input that expands into a very large float32 PCM allocation, bypassing the duration guard already used by /v1/audio/transcriptions and causing an out-of-memory worker crash. Inline data URLs reach this path without being bounded by VLLM_AUDIO_FETCH_TIMEOUT. The issue affects deployments serving an audio-capable model, and authentication changes only the deployment-specific reachability. This issue is fixed in version 0.24.0.

Rincian

Terbit di NVD

16 September 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 53,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vllm-project/vllm/security/advisories/GHSA-hcwq-8wjf-3gcr advisory vendor
• https://github.com/vllm-project/vllm/commit/3d20275bb4d434f53055c3c0b645fd8bb072965e patch
• https://github.com/vllm-project/vllm/pull/45908 issue tracking · patch
• https://github.com/vllm-project/vllm/releases/tag/v0.24.0 release notes