GHSA-HCWQ-8WJF-3GCR
Vulnerability from github – Published: 2026-09-16 22:12 – Updated: 2026-09-16 22:12Summary
The audio decode-duration guard (max_duration_s, env VLLM_MAX_AUDIO_DECODE_DURATION_S, default 600s) that protects against audio decompression-bomb DoS is wired into only the speech-to-text path (/v1/audio/transcriptions). The chat audio path (/v1/chat/completions, input_audio content parts) calls the same decoder with no limit, so an unauthenticated client can submit a few-KB compressed audio file that expands to multiple GB of float32 PCM at decode time, OOM-killing the worker. This is a distinct sibling of CVE-2026-5497 (video frame-count bomb, VideoMediaIO.load_base64) and GHSA-pq5c-rjhq-qp7p (image) in the same media subsystem.
Verified against main at HEAD d78650c (2026-06-16); applicable to the latest release v0.23.0.
Details
The guard rejects long audio during decode (before allocation), implemented in vllm/multimodal/media/audio.py:
- load_audio_pyav — metadata reject (~82-98) and live sample-count reject (~129-136)
- load_audio_soundfile — frames reject (~165-174)
All are gated on if max_duration_s is not None.
It is passed in exactly one place — the transcription serving layer:
# .../speech_to_text/base/serving.py:~170-174
load_audio(buf, sr=..., max_duration_s=self.max_audio_decode_duration_s)
# self.max_audio_decode_duration_s = envs.VLLM_MAX_AUDIO_DECODE_DURATION_S (default 600)
The chat path never threads it:
# vllm/multimodal/media/audio.py:237-238
def load_bytes(self, data: bytes) -> tuple[npt.NDArray, float]:
return load_audio(BytesIO(data), sr=None) # no max_duration_s -> every guard above is skipped
Unauthenticated reachability chain (chat):
parse_input_audio (chat_utils.py) -> parse_audio -> connector.fetch_audio -> AudioMediaIO._load_data_url -> load_base64 -> load_bytes -> load_audio(..., sr=None). The connector never passes max_duration_s, and inline data: URLs need no HTTP fetch (so VLLM_AUDIO_FETCH_TIMEOUT does not bound them). The OpenAI-compatible server has no auth by default (auth only when --api-key / VLLM_API_KEY is set).
Impact
Unauthenticated remote denial of service (availability) via memory amplification on a default-no-auth endpoint, on any deployment serving an audio-capable model. Same class and impact as the sibling CVE-2026-5497 (video). CWE-770 / CWE-409.
Fix
A fix was introduced in this MR: https://github.com/vllm-project/vllm/pull/45908
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.23.0"
},
"package": {
"ecosystem": "PyPI",
"name": "vllm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.24.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-57173"
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-16T22:12:17Z",
"nvd_published_at": "2026-09-16T17:17:24Z",
"severity": "MODERATE"
},
"details": "### Summary\nThe audio decode-duration guard (`max_duration_s`, env `VLLM_MAX_AUDIO_DECODE_DURATION_S`, default 600s) that protects against audio decompression-bomb DoS is wired into **only** the speech-to-text path (`/v1/audio/transcriptions`). The **chat** audio path (`/v1/chat/completions`, `input_audio` content parts) calls the same decoder with **no** limit, so an **unauthenticated** client can submit a few-KB compressed audio file that expands to multiple GB of float32 PCM at decode time, OOM-killing the worker. This is a distinct sibling of **CVE-2026-5497** (video frame-count bomb, `VideoMediaIO.load_base64`) and **GHSA-pq5c-rjhq-qp7p** (image) in the same media subsystem.\n\nVerified against `main` at HEAD `d78650c` (2026-06-16); applicable to the latest release v0.23.0.\n\n### Details\nThe guard rejects long audio *during* decode (before allocation), implemented in `vllm/multimodal/media/audio.py`:\n- `load_audio_pyav` \u2014 metadata reject (~82-98) and live sample-count reject (~129-136)\n- `load_audio_soundfile` \u2014 frames reject (~165-174)\n\nAll are gated on `if max_duration_s is not None`.\n\nIt is passed in exactly **one** place \u2014 the transcription serving layer:\n```python\n# .../speech_to_text/base/serving.py:~170-174\nload_audio(buf, sr=..., max_duration_s=self.max_audio_decode_duration_s)\n# self.max_audio_decode_duration_s = envs.VLLM_MAX_AUDIO_DECODE_DURATION_S (default 600)\n```\n\nThe chat path never threads it:\n```python\n# vllm/multimodal/media/audio.py:237-238\ndef load_bytes(self, data: bytes) -\u003e tuple[npt.NDArray, float]:\n return load_audio(BytesIO(data), sr=None) # no max_duration_s -\u003e every guard above is skipped\n```\n\nUnauthenticated reachability chain (chat):\n`parse_input_audio` (`chat_utils.py`) -\u003e `parse_audio` -\u003e `connector.fetch_audio` -\u003e `AudioMediaIO._load_data_url` -\u003e `load_base64` -\u003e `load_bytes` -\u003e `load_audio(..., sr=None)`. The connector never passes `max_duration_s`, and inline `data:` URLs need no HTTP fetch (so `VLLM_AUDIO_FETCH_TIMEOUT` does not bound them). The OpenAI-compatible server has no auth by default (auth only when `--api-key` / `VLLM_API_KEY` is set).\n\n### Impact\nUnauthenticated remote denial of service (availability) via memory amplification on a default-no-auth endpoint, on any deployment serving an audio-capable model. Same class and impact as the sibling CVE-2026-5497 (video). CWE-770 / CWE-409.\n\n### Fix\nA fix was introduced in this MR: https://github.com/vllm-project/vllm/pull/45908",
"id": "GHSA-hcwq-8wjf-3gcr",
"modified": "2026-09-16T22:12:18Z",
"published": "2026-09-16T22:12:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-hcwq-8wjf-3gcr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57173"
},
{
"type": "WEB",
"url": "https://github.com/vllm-project/vllm/pull/45908"
},
{
"type": "WEB",
"url": "https://github.com/vllm-project/vllm/commit/3d20275bb4d434f53055c3c0b645fd8bb072965e"
},
{
"type": "PACKAGE",
"url": "https://github.com/vllm-project/vllm"
},
{
"type": "WEB",
"url": "https://github.com/vllm-project/vllm/releases/tag/v0.24.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.