Inference infrastructure

From vLLM 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/translations routes call request.file.read() and fully load an uploaded audio file into memory before the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB size limit (default 25 MB) is checked during speech-to-text preprocessing. An API caller who can reach these routes can submit an oversized multipart upload, causing memory allocation proportional to the file size before rejection, which can create memory pressure or terminate the process depending on deployment resource limits.

NVIDIA Triton Inference Server for Linux contains a vulnerability, CVE-2026-24266, where an attacker can cause a use-after-free issue (CWE-416). A successful exploit might lead to denial of service. NVD has not yet provided an assessment.

Open WebUI, a self-hosted AI platform, prior to 0.9.6 has several direct, index-addressed Ollama proxy routes that accept a caller-supplied url_idx path parameter and use it as a raw index into the admin-configured OLLAMA_BASE_URLS list. Access control checks only whether the user may use the requested model, not which backend receives the request, so any authenticated user can route requests to Ollama backends they were never authorized to reach, including internal, higher-privilege, or admin-disabled ones.

CVE-2025-71379 affects vLLM versions >= 0.6.3 and < 0.9.0, which contain multiple regular expression denial of service (ReDoS) vulnerabilities. Regex patterns in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.

vLLM's `/v1/audio/transcriptions` endpoint limits the compressed upload size but not the decoded PCM output, so a 25MB OPUS file expands to about 14.9GB of float32 PCM at decode time, tested on v0.19.0. An unauthenticated attacker can exhaust server memory with a few concurrent requests, each a valid upload within the documented limit, because the audio decoder in `audio.py` accumulates all frames without a size check and `np.concatenate` allocates a second contiguous array.

The fix for CVE-2026-22778 / GHSA-4r2x-xpjr-7cvv (PRs #31987 and #32319) added `sanitize_message` at four OpenAI router exception sites, but later vLLM response paths still return `str(exc)` unsanitized. Malformed image bytes make PIL raise `UnidentifiedImageError` with a BytesIO object repr containing a heap address, which these paths echo to clients in `main` HEAD (`771e1e48b`, 2026-05-26). The paths listed are `vllm/entrypoints/anthropic/api_router.py` (lines 78 and 124), `vllm/entrypoints/anthropic/serving.py` (line 808), and `vllm/entrypoints/speech_to_text/realtime/connection.py` (lines 75 and 265).

vLLM's GGUF dequantize kernels in csrc/quantization/gguf/gguf_kernel.cu truncate tensor element counts because the to_cuda_ggml_t function pointer takes the count as a 32-bit int, while the caller passes m * n. The output tensors are allocated with torch::empty and left uninitialized, so when m * n exceeds INT_MAX the unfilled portion retains stale GPU memory. In multi-tenant serving this residual memory may contain other users' inference data, a silent confidentiality violation.

GHSA-8jr5-v98p-w75m affects vLLM's image input handling in vllm/multimodal/image.py. The code never calls ImageOps.exif_transpose, so EXIF orientation is not normalized, and PNGs carrying tRNS transparency in P, L or RGB modes take the image.convert("RGB") path without being flattened against a background, so transparent or overlay content can become visible and change the pixels the model receives. Pillow also loads only the first frame of APNG and GIF files.

vLLM's temperature validation in sampling_params.py uses comparison operators that evaluate to False for NaN and positive Infinity, so both values pass every guard. These values reach GPU sampling kernels, where they cause undefined behavior or CUDA errors that can crash the inference worker and degrade service for all concurrent users. The source notes that -Infinity is correctly rejected.

GHSA-3ww4-5jv9-j5gm reports that vLLM's revision pinning does not consistently cover all artifacts loaded for a model. Deployments that set `--revision` or `--code-revision` can still load dynamic code, GGUF files, image processors, retrieval side weights, or same-repository subfolder weights and config from an unpinned or default revision, so the pin does not describe the full artifact set served. The source states this is not a `trust_remote_code=False` bypass, unauthenticated RCE, or a demonstrated artifact compromise. The strongest example is Kimi-Audio, whose `whisper-large-v3` subfolder loads outside the configured revision.

CVE-2026-9540 affects vllm-project vllm 0.19.0 and lies in unspecified processing of the OpenAI-compatible Serving Path. Remote manipulation of this component leads to denial of service, and the exploit is publicly available. The CVSS 4.0 base score from CNA VulDB is 5.5 (MEDIUM), and the weakness is CWE-404, Improper Resource Shutdown or Release.

CVE-2026-24215 affects the DALI backend of NVIDIA Triton Inference Server. An attacker could cause uncontrolled resource consumption, which might lead to denial of service. NVD has not yet provided an assessment, and the source names no affected versions.