Inference infrastructure

vLLM versions before 0.29.0 do not enforce the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit during multimodal chat audio decoding. Unauthenticated clients can submit oversized audio files through chat endpoints, consuming excessive memory and CPU during decoding.

vLLM versions before 0.29.0 have a denial-of-service flaw in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints. The parameter has no maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send multi-hundred-megabyte salt values that trigger expensive pickle serialization and SHA-256 hashing, stalling the scheduler and denying service to all concurrent requests.

CVE-2026-94625 affects vLLM through 0.29.0 in MooncakeConnector. Rejected prefill requests leave ownerless transfer placeholders that are never reclaimed, so an attacker can send such requests to exhaust sender task pools. Valid requests can then be delayed by up to 480 seconds while health checks keep returning success.

vLLM versions prior to 0.28.0 let Chat Completions and Responses request bodies select the pynvvideocodec video backend through media_io_kwargs.video.video_backend, even when startup configuration chose a software decoder. The engine budgets decoder GPU memory only from static configuration, so the request-selected backend's CUDA context, decoder surfaces and decoded-frame allocations escape the KV-cache budget. An attacker who can submit video requests to a video-capable GPU deployment with PyNvVideoCodec installed can exhaust shared GPU memory, causing request failures, worker crashes or denial of service.

vLLM versions prior to 0.24.0 have an input_audio handling flaw on the /v1/chat/completions endpoint. The path calls AudioMediaIO.load_bytes or AudioMediaIO.load_file without passing VLLM_MAX_AUDIO_DECODE_DURATION_S to the shared audio decoder, so the duration guard used by /v1/audio/transcriptions is bypassed. An unauthenticated client can submit a small compressed audio input that expands into a very large float32 PCM allocation, causing an out-of-memory worker crash. Inline data URLs are also not bounded by VLLM_AUDIO_FETCH_TIMEOUT. The issue affects deployments serving an audio-capable model, and authentication changes only deployment-specific reachability.

A vulnerability was found in vllm-project vllm up to 0.29.0. The flaw sits in unspecified functionality of vllm/v1/sample/thinking_budget_state.py and is triggered by manipulation that results in inefficient algorithmic complexity. It can be exploited remotely.

A vulnerability in vllm-project vLLM 0.26.0 and 0.27.0 affects the MoRIIO Acknowledgement Handler in vllm/distributed/kv_transfer/kv_connector/v1/moriio/moriio_connector.py, specifically MoRIIOConnectorScheduler.request_finished, MoRIIOConnectorWorker.get_finished and MoRIIOWrapper._handle_release_message. Manipulating the request_id or kv_transfer_params argument causes resource consumption, and the attack can be launched remotely. The project was notified early through a pull request but had not responded at the time of disclosure.

A vulnerability in vllm-project vLLM up to 0.27.1 affects an unspecified part of the /v1/chat/completions endpoint, in the Jinja Template Rendering component. Manipulating the chat_template argument causes resource consumption, and the attack can be launched remotely. The exploit is publicly disclosed and may be used.