vLLM: audio input in chat completions skips the decode-duration limit, letting a small clip OOM the worker

Impact

The input_audio handler for /v1/chat/completions calls AudioMediaIO.load_bytes/load_file without passing VLLM_MAX_AUDIO_DECODE_DURATION_S, so the duration cap that protects /v1/audio/transcriptions never applies. A small, heavily compressed clip expands into a very large float32 PCM buffer and takes the worker out of memory; inline data URLs reach this path without even being bounded by VLLM_AUDIO_FETCH_TIMEOUT. On a GPU node, a crashed vLLM worker drops every in-flight request on those GPUs and the restart has to reload model weights, so recovery is measured in minutes, not seconds. Only deployments serving an audio-capable model are affected; whether the request needs authentication depends on how the endpoint is fronted.

Who can reach it

Any client that can POST to /v1/chat/completions on an audio-capable vLLM deployment. The advisory notes authentication only changes deployment-specific reachability - if the endpoint is exposed unauthenticated, so is the bug.

What to do

Upgrade vLLM to 0.24.0 and restart the serving processes - a rolling restart per replica, no node drain. If an upgrade cannot happen now, stop serving audio-capable models on exposed endpoints or put a proxy in front that rejects input_audio payloads and oversized data URLs.

References

Related entries

• MLflow: missing permission check on runs/log-inputs lets any user forge another run's lineageCVE-2026-69146 · MLflow tracking server auth plugin (mlflow/server/auth, runs/log-inputs endpoint)Medium
• vLLM: request-selected video decoder backend allocates GPU memory outside the KV-cache budgetCVE-2026-69147 · vLLM (MediaConnector video backend selection / GPU memory budgeting)Medium
• vLLM: unbounded prompt array in /v1/completions lets one request exhaust the engineCVE-2026-73559 · vLLM OpenAI-compatible server (/v1/completions prompt list)Medium
• vLLM: MiMo-V2-Omni processor bypasses media allowlists, enabling SSRF and local file readsCVE-2026-73560 · vLLM MiMoV2OmniMultiModalProcessor (media fetching in transformers_utils/processors/mimo_v2_omni.py)Medium
• OpenShift AI dashboard: unauthorized Secret read exposes the cluster NGC API key and NIM pull secretCVE-2026-86332 · Red Hat OpenShift AI odh-dashboard (GET /api/nim-serving/:nimResource)Medium
• Keras: malicious .keras/.h5 weights file reads arbitrary local files via HDF5 ExternalLinksCVE-2026-9335 · Keras (KerasFileEditor and keras.saving.load_weights HDF5 ExternalLink handling)Medium