CVE-2026-57173: vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions
The audio decode-duration guard (max_duration_s, env VLLM_MAX_AUDIO_DECODE_DURATION_S, default 600s) that protects against audio decompression-bomb DoS is wired into only the speech-to-text path (/v1/audio/transcriptions). The chat audio path (/v1/chat/completions, input_audio content parts) calls the same decoder with no limit, so an unauthenticated client can submit a few-KB compressed audio file that expands to multiple GB of float32 PCM at decode time, OOM-killing the worker. This is a distinct sibling of CVE-2026-5497 (video frame-count bomb, VideoMediaIO.load_base64) and GHSA-pq5c-rjhq-qp7p (image) in the same media subsystem.
Verified against main at HEAD d78650c (2026-06-16); applicable to the latest release v0.23.0.
References
- github.com/advisories/GHSA-hcwq-8wjf-3gcr
- github.com/vllm-project/vllm/commit/3d20275bb4d434f53055c3c0b645fd8bb072965e
- github.com/vllm-project/vllm/pull/45908
- github.com/vllm-project/vllm/releases/tag/v0.24.0
- github.com/vllm-project/vllm/security/advisories/GHSA-hcwq-8wjf-3gcr
- nvd.nist.gov/vuln/detail/CVE-2026-57173
Code Behaviors & Features
Detect and mitigate CVE-2026-57173 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →