MediumVulnerabilityLLM-specific
CVE-2026-100648: vllm audio decoding bypasses file size limit in multimodal chat
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-100648
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
vLLM versions before 0.29.0 do not enforce the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit during multimodal chat audio decoding. Unauthenticated clients can submit oversized audio files through chat endpoints, consuming excessive memory and CPU during decoding.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Topics
Related items
- MediumEndor Labs’ AI SAST Finds Zero Day Memory-Amplification DoS in Anthropic’s buffa library | Endor LabsSimilar attack · Endor Labs Blog
- MediumCVE-2026-44627: Intel oneDNN integer overflow to buffer overflow in Ring 3 user applicationsSimilar attack · NVD/CVE Database
- MediumGHSA-h7c4-q426-7jh9: tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clientsSimilar attack · GitHub Advisory Database
- HighGHSA-4p8p-pjpq-2w7h: tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processSimilar attack · GitHub Advisory Database
- HighGHSA-447x-qqwf-m7xq: tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoSSimilar attack · GitHub Advisory Database