Database/AI/ML frameworks & serving
vLLM: forged FLAC sample rate bypasses duration limit and crashes the API server
Impact
The transcription endpoint trusts the sample rate declared in the uploaded audio header, so the duration check it feeds can be inflated arbitrarily. A single small FLAC file with a forged header drives a very large allocation and takes down the API server process. Because one vLLM server fronts a whole GPU or a whole node and serves every tenant behind it, this is a cross-tenant outage from one authenticated request, and it is trivially repeatable - restarting the process only restores service until the next request arrives.
Who can reach it
Any authenticated client that can POST to the transcription endpoint. Network reachable; low privilege, no special role needed.
What to do
Upgrade to vLLM 0.28.0 and restart the serving processes - a rolling restart of API replicas, no node drain. In the interim, cap request body size at the ingress, rate-limit the transcription route per tenant, and run the server under a supervisor that restarts it, or disable the transcription endpoint if it is not in use.
References
Related entries
- Hugging Face Transformers: path traversal in save_pretrained() writes files outside the save directoryCVE-2026-9856 · Hugging Face Transformers - save_pretrained() in PreTrainedTokenizerBase and ProcessorMixinHigh
- MLflow (`spark_udf` dir perms): Excessive directory permissionsCVE-2024-27134 · MLflow (`spark_udf` dir perms)High
- NVIDIA NemoClaw: code injection in the migration command gives a local user execution as the tool's privilegesCVE-2026-65082 · NVIDIA NemoClaw for Linux (migration command)High
- llama.cpp ggml RPC server: unvalidated tensor op and op_params in deserialize_tensorCVE-2026-78147 · llama.cpp ggml RPC server (deserialize_tensor op / op_params validation)Medium
- llama.cpp ggml RPC server: null pointer dereference in graph_compute kills the GPU workerCVE-2026-78148 · llama.cpp ggml RPC server (rpc_server::graph_compute)Medium
- BentoML: SSRF filter misses 100.64.0.0/10, so serving pods fetch from internal CGNAT hostsCVE-2026-78205 · BentoML make_safe_connect (SSRF address filter, RFC 6598 range)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.