What’s Vulnerable › Vulnerabilities

CVE-2026-114052: vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-22
• Weakness: CWE-770

Description

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.

Affected products

• vllm-project vllm: from 0.25.0 before 0.31.0 — fixed in 0.31.0

How to fix

Upgrade to a fixed version: vllm-project vllm 0.31.0. Check the vendor advisory for mitigations.

References

• https://github.com/vllm-project/vllm/security/advisories/GHSA-823j-m4cj-hmjf
• https://www.vulncheck.com/advisories/vllm-0.25.0-before-0.31.0-moss-audio-memory-exhaustion-via-tokenize-mm-processor-kwargs

Get alerted when CVE-2026-114052 or the next vulnerability affects your stack