Description

vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decoding.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-26T14:16:47.240Z",
  "pubdate": "2026-09-26T14:16:47.240Z",
  "executiveSummary": "The vLLM framework, specifically in versions prior to 0.29.0, contains a critical vulnerability regarding the enforcement of multimodal input constraints. A logic flaw in the audio decoding pipeline prevents the application from honoring the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB configuration parameter.\nThis vulnerability is classified as a Denial of Service (DoS) risk caused by improper resource management. An unauthenticated remote attacker can submit arbitrarily large audio files to the chat endpoint, bypassing established file size restrictions. By forcing the server to process excessively large payloads, the attacker triggers disproportionate memory allocation and CPU utilization during the decoding phase.\nThe primary risk implication is the potential for service instability, system-wide resource exhaustion, and application crashes, effectively rendering the vLLM instance unavailable to legitimate users. Exploitation requires only basic network access to the target's chat endpoint, with no authentication or elevated privileges necessary. Organizations relying on vLLM for multimodal inference are at risk of resource depletion attacks if they remain on affected versions.",
  "technicalDetails": "The vulnerability resides within the multimodal chat processing component of vLLM, specifically where input audio data is ingested and decoded. The system is designed to utilize the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB environment variable to define an upper threshold for audio file uploads, intended to prevent resource-heavy operations on oversized inputs. In versions before 0.29.0, this validation logic fails to correctly intercept or validate the file size against the defined limit prior to passing the data to the downstream decoding functions.\nThe attack flow begins with an unauthenticated client sending a multipart/form-data or similar request containing an oversized audio file to the vLLM chat endpoint. Because the input validation mechanism is bypassed, the framework accepts the payload and initiates the decoding pipeline. The internal decoder proceeds to allocate memory buffers proportional to the size of the input file. When processing multi-megabyte or gigabyte-scale files, these allocations rapidly consume available system RAM.\nFurthermore, the decoding process is computationally expensive, involving transcoding or feature extraction phases that spike CPU utilization. Because vLLM often operates in highly concurrent environments, an attacker can dispatch multiple concurrent requests containing oversized audio blobs. This leads to a cascade failure where the worker nodes reach their memory limits, triggering OOM (Out of Memory) kills or severe latency spikes that block all other inference requests.\nThe root cause is a failure in the input sanitization layer. The logic does not verify the content length or the binary size of the audio clip against the configured threshold before the data enters the memory-intensive decoding phase. This lack of pre-processing validation allows an attacker to interact directly with the backend resource management functions without passing through a gatekeeper check.\nThe vulnerability affects all multimodal deployments of vLLM earlier than 0.29.0. Exploitation is trivial and highly repeatable, as it does not require knowledge of internal system states or specific model architectures. Once the audio stream is parsed, the resource consumption is immediate and direct, typically resulting in a crash of the inference process, forcing a restart of the model service."
}