CVE-2026-100648
Received Received - Intake

VLLM Memory Exhaustion via Unrestricted Audio File Upload

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decoding.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100648
EUVD
EUVD-2026-87742

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vllm_project vllm to 0.29.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the vllm library versions before 0.29.0. It involves uncontrolled resource consumption during multimodal chat audio decoding where the system fails to enforce the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit. Unauthenticated clients can upload oversized audio files through chat endpoints, causing excessive memory and CPU usage during decoding.

Detection Guidance

Monitor for unusually high memory or CPU usage during audio file processing in vllm instances running versions prior to 0.29.0. Check logs for large audio file uploads via chat endpoints and verify if VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limits are enforced.

Impact Analysis

Attackers can exploit this to consume excessive server resources by submitting large audio files, potentially leading to degraded performance, service outages, or increased operational costs due to high CPU and memory usage.

Mitigation Strategies

Upgrade vllm to version 0.29.0 or later to enforce the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit. If upgrading is not possible, restrict access to chat endpoints handling audio uploads and implement network-level monitoring for large file transfers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100648. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart