CVE-2026-55646

Name of the Vulnerable Software and Affected Versions vLLM versions 0.22.0 through 0.23.0

Description The software fails to validate the size of uploaded audio files before loading them into memory. Specifically, the endpoints '/v1/audio/transcriptions' and '/v1/audio/translations' execute the request.file.read() function to fully materialize the file in memory before verifying the VLLM MAX AUDIO CLIP FILESIZE MB limit. This allows an attacker to submit an oversized multipart upload, leading to excessive memory allocation that can cause memory pressure or terminate the process.

Recommendations Update to version 0.24.0.