Description

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-12T13:16:54.180Z",
  "pubdate": "2026-09-12T13:16:54.180Z",
  "executiveSummary": "A critical resource exhaustion vulnerability exists in vLLM versions prior to 0.28.0 within the transcription endpoint. The vulnerability arises from a failure to validate audio sample rate metadata in FLAC headers, allowing an authenticated attacker to bypass inherent duration and processing constraints.\nBy manipulating the sample rate field within the audio file header, a malicious actor can force the application to perform excessive memory allocation during the decoding or transcription preprocessing phase. This results in an out-of-memory (OOM) condition, leading to the immediate termination of the API server process.\nAs the vLLM API server typically manages workloads for multiple tenants, this crash causes a total denial-of-service (DoS) for the entire instance, impacting all concurrent users. Successful exploitation requires network access to the transcription endpoint and valid user authentication, making this a significant threat to service availability and system stability.",
  "technicalDetails": "The vulnerability resides in the vLLM transcription pipeline's handling of audio input headers. Specifically, the system processes FLAC audio files without performing rigorous input validation on the sample rate metadata contained within the file's header section. This oversight allows an attacker to supply a forged FLAC header where the sample rate value is artificially inflated.\nWhen the vLLM transcription endpoint receives an audio request, it initiates a decoding process to prepare the raw audio data for model inference. The underlying decoding logic utilizes the sample rate provided in the header to pre-allocate memory buffers intended to store the reconstructed audio signal. Because the application trusts the header values without cross-referencing them against expected or reasonable limits, an attacker can submit a header indicating an exceptionally high sample rate.\nThe attack flow proceeds as follows: First, the authenticated attacker constructs a malicious FLAC file containing a manipulated header that specifies a significantly inflated sample rate. Second, the attacker transmits this payload via the API's transcription endpoint. Third, the vLLM server processes the header and, based on the falsified rate, calculates a massive memory requirement for the audio buffer. Fourth, the server attempts to allocate this memory, triggering a system-wide OOM event or an unhandled memory allocation failure within the process space.\nThe impact of this exploit is a process-level crash. Since the vLLM API server acts as a shared resource, this crash is not contained to the malicious user's request; it effectively severs the processing capabilities for all tenants currently connected to the server. This constitutes a permanent DoS condition until the service is manually restarted, as the process terminates abruptly. The vulnerability remains present in all versions prior to 0.28.0, and because it bypasses existing duration-based security checks, it essentially disables the primary mechanism designed to prevent such large-scale resource consumption. Exploitation does not require high-level privileges, only authenticated access to the specific transcription functionality, facilitating ease of execution for malicious actors operating within the authenticated perimeter."
}