What’s Vulnerable › Vulnerabilities

CVE-2026-100648: vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-26 · updated 2026-10-06
• Weakness: CWE-400

Description

vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decoding.

Affected products

• vllm-project vllm: before 0.29.0 — fixed in 0.29.0

How to fix

Upgrade to a fixed version: vllm-project vllm 0.29.0. Check the vendor advisory for mitigations.

References

• https://github.com/vllm-project/vllm/security/advisories/GHSA-jcq2-4gch-5qhf
• https://www.vulncheck.com/advisories/vllm-before-0.29.0-uncontrolled-resource-consumption-via-audio-decoding

Get alerted when CVE-2026-100648 or the next vulnerability affects your stack