Database/AI/ML frameworks & serving
vLLM: Phi-4 audio encoder materializes quadratic attention matrices, letting one long clip OOM the engine
Impact
The Phi-4 multimodal audio encoder defaults to eager attention, and MultiHeadedAttention.forward_attention materializes the full attention matrices and retains them in self.attn. A single legal long audio clip therefore drives quadratic GPU memory use, ending in an out-of-memory condition that terminates EngineCore for every user on that server - not just the submitting request. The scaled dot-product attention branch does not materialize those matrices, so exposure is specific to the eager default. On a multi-tenant GPU node this is one request from one tenant taking the shared model offline, and restarting means re-loading weights onto the device.
Who can reach it
An authenticated remote client of the OpenAI-compatible API on a vLLM server serving a Phi-4 multimodal model with audio input. No special privileges beyond being able to submit a request.
What to do
Upgrade to vLLM 0.32.0 (fix commit 3d52578e) and restart the affected replicas; the cost is a model reload per replica, not a node drain. Interim options: stop serving Phi-4 multimodal audio, or cap accepted audio duration at the ingress ahead of vLLM.
References
Related entries
- vLLM: an all-zero image on the DeepSeek-OCR path trips a fatal assertion and shuts the engine downCVE-2026-115914 · vLLM DeepSeek-OCR image path (_parse_and_validate_image_input / sanity_check_mm_encoder_outputs)Medium
- vLLM: off-by-one prompt-token-ID bound lets a request crash the inference engineCVE-2026-115916 · vLLM tokenizer input validation (vllm/tokenizers/hf.py max_token_id)Medium
- vLLM: request-supplied chat template bypasses trust_request_chat_template and exhausts the serverCVE-2026-115918 · vLLM /v1/responses endpoint (chat_template_kwargs trust policy)Medium
- MLflow: CrewAI autologging writes provider API keys in plaintext into tracesCVE-2026-116691 · MLflow CrewAI autologging (mlflow/crewai/autolog.py agent attribute capture)Medium
- Kubeflow Pipelines: frontend artifact routes skip namespace authorization, exposing other tenants' artifactsCVE-2026-118760 · Kubeflow Pipelines frontend (artifact routes, namespace authorization)Medium
- vLLM: unbounded frame count in video/jpeg base64 data URLs crashes the server with OOMCVE-2026-34755 · vLLM OpenAI-compatible API server (video/jpeg base64 multimodal path)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.