Database/AI/ML frameworks & serving
vLLM (MOSS-Audio multimodal processor cache, /tokenize endpoint): vLLM caches a processor object for every distinct
Impact
vLLM caches a processor object for every distinct request-controlled mm_processor_kwargs value in a dictionary with no bound. An attacker sending a stream of distinct or oversized mel_config values drives host memory to exhaustion and the API process dies. The /tokenize endpoint is reachable without a key even when --api-key is set, so the usual authentication control does not stop it. On a GPU node this takes out the serving process holding the GPUs for every tenant on that endpoint, and the restart reloads weights, so recovery is minutes of lost inference capacity, not seconds.
Who can reach it
Anyone who can reach the vLLM HTTP endpoint. No authentication required - /tokenize bypasses --api-key. Applies to deployments serving MOSS-Audio.
What to do
Upgrade vLLM to 0.31.0 and restart the serving process, which is a rolling restart of each model replica and reloads weights. Until then, keep the vLLM port off any network a tenant can reach and put an authenticating proxy in front of it, blocking or rate-limiting /tokenize specifically.
References
Related entries
- vLLM: client-supplied multimodal processor parameters exhaust memory and kill the shared serverCVE-2026-114055 · vLLM (per-request mm_processor_kwargs in Isaac, InternVL, H2OVL multimodal processors)High
- KubeAI (Ollama engine controller): Injection in `ollamaStartupProbeScript()`CVE-2026-34940 · KubeAI (Ollama engine controller)High
- Xinference: model launch API executes attacker-supplied Python because trust_remote_code is always onCVE-2026-76841 · Xinference (Xorbits Inference) model loaders - trust_remote_codeHigh
- Coze Studio: any registered user gets code execution from a workflow code node by defaultCVE-2026-77934 · Coze Studio (workflow code node, unsandboxed python3 subprocess)High
- Ollama: model pull follows cross-host redirects, giving SSRF to internal and metadata endpointsCVE-2026-85180 · Ollama (tensor-layer blob download, cross-host redirect handling)High
- Axolotl: multipack patch loads Hugging Face base models with trust_remote_code=True, giving RCE on the training nodeCVE-2026-86169 · Axolotl (multipack patch path, trust_remote_code guard)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.