vLLM: audio extracted from video input ignores decode size and duration limits

Impact

When a NanoNemotronVL model is served with use_audio_in_video=True, audio pulled out of a video input is decoded without max_duration_s or max_decode_bytes, so neither VLLM_MAX_AUDIO_DECODE_DURATION_S nor VLLM_MAX_AUDIO_DECODE_BYTES applies - the limits an operator set on the direct audio upload path silently do not cover this one. A small, highly compressed video therefore forces gigabytes of host memory allocation during decode. On a packed GPU node that is a memory-pressure event for every workload sharing the host, not just for the model being attacked, and it is caused by an ordinary-looking multimodal request. Affects 0.10.2 up to 0.28.0; installations not serving NanoNemotronVL with audio-in-video enabled are not exposed.

Who can reach it

Any client that can submit multimodal input to a NanoNemotronVL endpoint configured with use_audio_in_video=True. The record rates the vector as local with no privileges required; in practice it is whoever reaches the inference API.

What to do

Upgrade to vLLM 0.28.0 and restart the serving processes - a rolling restart, no node drain. If you cannot upgrade now, run these models with use_audio_in_video disabled, or cap request size and per-tenant memory at the pod level, since the decode-limit environment variables do not cover this path.

References

Related entries

• vLLM: unvalidated MoRIIO ack fields let a remote client exhaust resources on a serving nodeCVE-2026-92220 · vLLM MoRIIO KV-transfer connector (acknowledgement handler)Medium
• vLLM: rejected prefill requests leak Mooncake transfer placeholders, stalling valid requestsCVE-2026-94625 · vLLM MooncakeConnector (KV transfer placeholder reclamation)Medium
• llama.cpp: heap out-of-bounds read in vocab print_info crashes model loading on a crafted GGUF tokenizerCVE-2025-71439 · llama.cpp llama_vocab::impl::print_info() (tokenizer.ggml.tokens bounds)Medium
• JupyterLab: language-pack Plural-Forms header reaches new Function, executing code in the session originCVE-2026-102830 · JupyterLab / JupyterLite (translation catalogue Plural-Forms parser)Medium
• ONNX: symlink-following external-data write lets a local attacker append to victim-writable filesCVE-2026-49114 · ONNX Python library (save_external_data external-data path handling)Medium
• NVIDIA OpenShell: sandbox exec handler is vulnerable to OS command injection, breaking the sandbox boundaryCVE-2026-65086 · NVIDIA OpenShell for Linux (sandbox exec handler)Medium