CVE-2026-116175

vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions

Published Oct 25, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio via input_audio or audio_url in /v1/chat/completions requests that expands to huge decoded PCM, exhausting server memory.

Analysis

Technical impact

vLLM versions from 0.19.0 up to before 0.24.0 contain a decompression bomb vulnerability in the AudioMediaIO multimodal path. Maliciously sized audio files sent via the input_audio or audio_url parameter in the /v1/chat/completions endpoint are decoded into an unbounded PCM buffer. The inflated buffer consumes large amounts of memory, eventually crashing or killing the server process, resulting in a denial of service for all users interacting with the model. This flaw corresponds to CWE‑409, an inappropriate restriction of operations that can cause resource exhaustion.

Affected Systems

All releases of vLLM from 0.19.0 through 0.23.x are affected. The vulnerable product is the official vLLM library from the vllm‑project. The issue is reported to have been resolved in v0.24.0 and later. The known platform enumeration string matches the main vLLM package.

Risk and Exploitability

The CVSS score of 7.1 indicates moderate‑severe risk. EPSS data is not available, so the exploitation probability is currently unknown. The vulnerability does not appear in the CISA KEV catalog. Because authentication to the chat endpoint is required, attackers need valid credentials or a session with the model. Once authenticated, an attacker can submit a small compressed audio resource that expands to a large PCM buffer, exhausting memory and triggering a crash or slowdown. The impact is limited to service availability rather than confidentiality or integrity.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

vllm-project

vllm

unaffected

Version	Status	Constraints
`0.19.0`	affected	< 0.24.0
`0.24.0`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Vllm

Version	Status	Scheme	Platform
`[0.19.0,0.24.0)`	affected	semver	—
`0.24.0`	unaffected	semver	—

Vllm-project

Vllm

Version	Status	Scheme	Platform
`[0.19.0,0.24.0)`	affected	semver	—
`0.24.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade vLLM to version 0.24.0 or newer where the load_audio call is bounded and the vulnerability is fixed.
If an immediate upgrade is not possible, implement a server‑side check to reject audio inputs that would decode beyond a safe threshold, such as enforcing a maximum decoded duration or memory usage before processing.
Monitor the application for abnormal memory consumption, enforce a hard memory limit for the vLLM process, and restart it automatically when thresholds are exceeded.

Generated by OpenCVE AI on October 25, 2026 at 16:39 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.314% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/vllm-project/vllm/security/advisories/GHSA-r45p-7qwx-qwjw
https://nvd.nist.gov/vuln/detail/CVE-2026-116175
https://www.cve.org/CVERecord?id=CVE-2026-116175
https://www.vulncheck.com/advisories/vllm-0.19.0-before-0.24.0-audio-decompression-bomb-dos-via-chat-completions

History

Oct 26, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 12:30 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-116175 https://www.cve.org/CVERecord?id=CVE-2026-116175
Metrics	threat_severity `None`	threat_severity `Moderate`

Oct 25, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Vllm-project Vllm-project vllm
Vendors & Products		Vllm-project Vllm-project vllm

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio via input_audio or audio_url in /v1/chat/completions requests that expands to huge decoded PCM, exhausting server memory.
Title		vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions
First Time appeared		Vllm Vllm vllm
Weaknesses		CWE-409
CPEs		cpe:2.3:a:vllm:vllm::::::::
Vendors & Products		Vllm Vllm vllm
References		https://github.com/vllm-project/vllm/security/advisories/GHSA-r45p-7qwx-qwjw https://www.vulncheck.com/advisories/vllm-0.19.0-before-0.24.0-audio-decompression-bomb-dos-via-chat-completions
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`