CVE-2026-57173: vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions
The audio decode-duration guard (max_duration_s, env VLLM_MAX_AUDIO_DECODE_DURATION_S, default 600s) that protects against audio decompression-bomb DoS is wired into only the speech-to-text path (/v1/audio/transcriptions). The chat audio path (/v1/chat/completions, input_audio content parts) calls the same decoder with no limit, so an unauthenticated client can submit a few-KB compressed audio file that expands to multiple GB of float32 PCM at decode time, OOM-killing the worker. This is a distinct sibling of CVE-2026-5497 (video frame-count bomb, VideoMediaIO.load_base64) and GHSA-pq5c-rjhq-qp7p (image) in the same media subsystem.
Verified against main at HEAD d78650c (2026-06-16); applicable to the latest release v0.23.0.
References
- github.com/advisories/GHSA-hcwq-8wjf-3gcr
- github.com/vllm-project/vllm/commit/3d20275bb4d434f53055c3c0b645fd8bb072965e
- github.com/vllm-project/vllm/pull/45908
- github.com/vllm-project/vllm/releases/tag/v0.24.0
- github.com/vllm-project/vllm/security/advisories/GHSA-hcwq-8wjf-3gcr
- nvd.nist.gov/vuln/detail/CVE-2026-57173
Code Behaviors & Features
Detect and mitigate CVE-2026-57173 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →