Database/AI/ML frameworks & serving
vLLM: forged FLAC sample rate bypasses duration limit and crashes the API server
Impact
The transcription endpoint trusts the sample rate declared in the uploaded audio header, so the duration check it feeds can be inflated arbitrarily. A single small FLAC file with a forged header drives a very large allocation and takes down the API server process. Because one vLLM server fronts a whole GPU or a whole node and serves every tenant behind it, this is a cross-tenant outage from one authenticated request, and it is trivially repeatable - restarting the process only restores service until the next request arrives.
Who can reach it
Any authenticated client that can POST to the transcription endpoint. Network reachable; low privilege, no special role needed.
What to do
Upgrade to vLLM 0.28.0 and restart the serving processes - a rolling restart of API replicas, no node drain. In the interim, cap request body size at the ingress, rate-limit the transcription route per tenant, and run the server under a supervisor that restarts it, or disable the transcription endpoint if it is not in use.
References
Related entries
- Hugging Face Transformers: path traversal in save_pretrained() writes files outside the save directoryCVE-2026-9856 · Hugging Face Transformers - save_pretrained() in PreTrainedTokenizerBase and ProcessorMixinHigh
- MLflow (`spark_udf` dir perms): Excessive directory permissionsCVE-2024-27134 · MLflow (`spark_udf` dir perms)High
- NVIDIA NemoClaw: code injection in the migration command gives a local user execution as the tool's privilegesCVE-2026-65082 · NVIDIA NemoClaw for Linux (migration command)High
- llama.cpp: crafted GGUF tensor offsets read memory outside the mapped model fileCVE-2024-58399 · llama.cpp llama_model_loader (GGUF tensor offsets)Medium
- vLLM: unbounded cache_salt stalls the EngineCore scheduler thread, denying service to all requestsCVE-2026-100647 · vLLM (OpenAI- and Anthropic-compatible API server, cache_salt handling)Medium
- vLLM: audio clip size limit not enforced, letting unauthenticated clients exhaust node memory and CPUCVE-2026-100648 · vLLM (multimodal chat audio decoding, VLLM_MAX_AUDIO_CLIP_FILESIZE_MB)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.