GPU VulnDB

Database/AI/ML frameworks & serving

vLLM: audio extracted from video input ignores decode size and duration limits

CVSS 6.9CVE-2026-90554AI/ML frameworks & servingcurated

Impact

When a NanoNemotronVL model is served with use_audio_in_video=True, audio pulled out of a video input is decoded without max_duration_s or max_decode_bytes, so neither VLLM_MAX_AUDIO_DECODE_DURATION_S nor VLLM_MAX_AUDIO_DECODE_BYTES applies - the limits an operator set on the direct audio upload path silently do not cover this one. A small, highly compressed video therefore forces gigabytes of host memory allocation during decode. On a packed GPU node that is a memory-pressure event for every workload sharing the host, not just for the model being attacked, and it is caused by an ordinary-looking multimodal request. Affects 0.10.2 up to 0.28.0; installations not serving NanoNemotronVL with audio-in-video enabled are not exposed.

Who can reach it

Any client that can submit multimodal input to a NanoNemotronVL endpoint configured with use_audio_in_video=True. The record rates the vector as local with no privileges required; in practice it is whoever reaches the inference API.

What to do

Upgrade to vLLM 0.28.0 and restart the serving processes - a rolling restart, no node drain. If you cannot upgrade now, run these models with use_audio_in_video disabled, or cap request size and per-tenant memory at the pod level, since the decode-limit environment variables do not cover this path.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-90554https://github.com/vllm-project/vllm/security/advisories/GHSA-936p-m5pv-vvjfhttps://www.vulncheck.com/advisories/vllm-before-0.28.0-denial-of-service-via-audio-extraction

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.