Database/AI/ML frameworks & serving
vLLM: audio clip size limit not enforced, letting unauthenticated clients exhaust node memory and CPU
Impact
The configured maximum audio clip size is not applied in the multimodal chat path, so a client can submit an oversized audio file and force the server to decode it. Decoding runs on the inference node and consumes host memory and CPU outside the GPU memory accounting, which starves the model server that shares the node. On a GPU fleet that means a single unauthenticated caller can degrade or stall an expensive accelerator node serving many users, and recovery usually means restarting the server process rather than a cheap throttle. NVD records availability impact only, no confidentiality or integrity effect.
Who can reach it
Anyone who can reach the vLLM chat endpoint over the network. The advisory states the clients are unauthenticated, so any exposure of the OpenAI-compatible API to tenants or to the internet is enough.
What to do
Upgrade vLLM to 0.29.0 or later and restart the serving processes; a rolling restart per replica is enough, no node drain or reboot. Until then, keep the multimodal chat endpoints behind an authenticating gateway that enforces its own request body size limit, or disable audio inputs.
References
Related entries
- Quarkus LangChain4j: unauthenticated CONNECT frames leak chat scopes until the JVM exitsCVE-2026-108748 · Quarkus LangChain4j chat-scopes WebSocket endpoint (/_chat/routes)Medium
- Crawl4AI: robots.txt fetch bypasses egress controls, giving blind SSRF to metadata endpointsCVE-2026-109239 · Crawl4AI (RobotsParser.can_fetch in the Docker server)Medium
- llama.cpp: reachable assertion in the Mirostat sampler aborts the server remotelyCVE-2026-116467 · llama.cpp Mirostat sampler (src/llama-sampler.cpp)Medium
- llama.cpp: integer overflow in GGUF tensor shape validation leads to out-of-bounds memory accessCVE-2026-116829 · llama.cpp gguf_init_from_reader (tensor element-count validation)Medium
- llama.cpp: integer overflow in GGUF tensor size padding yields an undersized data blob and out-of-bounds readsCVE-2026-116840 · llama.cpp (gguf_init_from_reader tensor size padding)Medium
- Crawl4AI: CacheValidator freshness check bypasses the egress proxy, giving blind SSRF from the crawler containerCVE-2026-119122 · Crawl4AI Docker server (CacheValidator freshness check)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.