CVE-2026-100648: vllm Audio Decoding DOS Vulnerability

CVE-2026-100648 Overview

CVE-2026-100648 affects vLLM versions before 0.29.0. The library fails to enforce the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit during multimodal chat audio decoding. Unauthenticated clients can submit oversized audio files through chat endpoints and bypass the intended file size restrictions. The decoder consumes excessive memory and CPU resources while processing attacker-supplied input. This classifies as uncontrolled resource consumption under [CWE-400].

Critical Impact
Remote unauthenticated attackers can exhaust server memory and CPU on vLLM inference endpoints by submitting oversized audio clips to multimodal chat APIs, degrading availability for all tenants of the service.

Affected Products

vLLM versions prior to 0.29.0
Deployments exposing multimodal chat endpoints with audio input support
Inference services relying on VLLM_MAX_AUDIO_CLIP_FILESIZE_MB for resource limits

Discovery Timeline

2026-09-26 - CVE-2026-100648 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100648

Vulnerability Analysis

vLLM is an open-source inference and serving engine for large language models. The engine supports multimodal chat requests, including audio inputs that are decoded server-side before being passed to the model. vLLM exposes the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB environment variable so operators can bound the size of accepted audio clips.

In versions before 0.29.0, the chat audio decoding path does not consult this configuration value. Operator-defined size limits never take effect, and the server accepts arbitrarily large audio payloads for decoding. Decoding large audio buffers allocates proportional memory and consumes CPU cycles for sample conversion.

An unauthenticated client can send repeated oversized audio requests to amplify the impact. The decoder saturates worker processes, blocks legitimate inference requests, and can trigger out-of-memory conditions on the host. The flaw affects availability only; confidentiality and integrity are not impacted.

Root Cause

The root cause is a missing enforcement check in the multimodal chat audio decoding routine. The code path reads client-supplied audio data but omits the size validation that would compare the payload against VLLM_MAX_AUDIO_CLIP_FILESIZE_MB before invoking the decoder. The configuration variable is effectively dead code on the audio ingestion path.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker crafts a chat completion request targeting a multimodal endpoint that accepts audio content. The request embeds or references an audio clip significantly larger than the configured limit. The server dispatches the payload to the decoder, which allocates buffers and processes samples without bound. Repeating this request against a vLLM instance exhausts memory or CPU, producing a denial-of-service condition.

No verified public exploit code is available. Technical details are documented in the GitHub Security Advisory GHSA-jcq2-4gch-5qhf.

Detection Methods for CVE-2026-100648

Indicators of Compromise

Chat completion requests with audio payloads substantially larger than the configured VLLM_MAX_AUDIO_CLIP_FILESIZE_MB value
Repeated multimodal requests from a single source IP targeting audio-enabled endpoints
Worker process memory growth or OOM-kill events correlated with inbound chat traffic

Detection Strategies

Inspect reverse-proxy or API gateway logs for POST requests to chat completion endpoints with Content-Length values exceeding operational norms
Alert on vLLM worker restarts, segfaults, or OOM kills reported by the container runtime or systemd
Baseline normal audio payload sizes and flag requests that deviate by more than one order of magnitude

Monitoring Recommendations

Enable per-endpoint request-size metrics on the ingress layer in front of vLLM
Track CPU, memory, and swap utilization on vLLM hosts with alerts tied to sustained saturation
Correlate client IP, request path, and resource utilization in a central log store to identify abusive patterns

How to Mitigate CVE-2026-100648

Immediate Actions Required

Upgrade vLLM to version 0.29.0 or later on all inference hosts
Place vLLM endpoints behind an authenticated reverse proxy or API gateway until patching is complete
Restrict chat endpoints to trusted networks when audio multimodal features are not required

Patch Information

vLLM 0.29.0 enforces the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in the audio decoding path. Operators should upgrade using their package manager or container registry and redeploy inference services. Confirm the installed version with pip show vllm or by inspecting the container image tag. Refer to the VulnCheck Advisory for vLLM for additional context.

Workarounds

Enforce request-body size limits at the reverse proxy (for example, client_max_body_size in NGINX) sized to the intended audio clip budget
Disable multimodal audio support in vLLM configuration if the workload does not require it
Apply rate limiting and per-client quotas on chat completion endpoints to blunt resource exhaustion attempts

bash

# Configuration example
# Upgrade vLLM to the patched release
pip install --upgrade "vllm>=0.29.0"

# NGINX ingress safeguard capping request bodies at 25 MB
server {
    location /v1/chat/completions {
        client_max_body_size 25m;
        limit_req zone=vllm_chat burst=10 nodelay;
        proxy_pass http://vllm_upstream;
    }
}