CVE-2026-114052

Name of the Vulnerable Software and Affected Versions vLLM versions 0.24.1 through 0.30.9

Description A memory exhaustion issue exists in MOSS-Audio model serving where a processor is cached for every distinct mm processor kwargs value within an unbounded dictionary. Unauthenticated attackers can exploit this by sending oversized or distinct mel config values to the '/tokenize' endpoint, which bypasses the --api-key requirement, leading to host memory exhaustion and a crash of the API process.

Recommendations Update vLLM to version 0.31.0 or later. Restrict access to the '/tokenize' endpoint to prevent unauthorized requests.