CVE-2026-90554: vLLM NanoNemotronVL DOS Vulnerability

CVE-2026-90554 Overview

CVE-2026-90554 is a denial-of-service vulnerability in vLLM, the high-throughput inference and serving engine for large language models. The flaw affects vLLM versions >=0.10.2 and <0.28.0 when serving NanoNemotronVL models with use_audio_in_video=True. The _extract_audio_from_videos function in nano_nemotron_vl.py calls load_audio_pyav(BytesIO(video_bytes)) without passing the max_duration_s or max_decode_bytes parameters. As a result, the environment limits VLLM_MAX_AUDIO_DECODE_DURATION_S and VLLM_MAX_AUDIO_DECODE_BYTES are not enforced. An attacker can submit a small, highly compressed video that forces the server to allocate gigabytes of memory during audio decoding.

Critical Impact
A single crafted multimodal request can exhaust server memory and crash vLLM inference workers serving NanoNemotronVL models.

Affected Products

vLLM versions >=0.10.2 and <0.28.0
NanoNemotronVL model deployments configured with use_audio_in_video=True
vLLM inference servers accepting multimodal video input

Discovery Timeline

2026-09-12 - CVE-2026-90554 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90554

Vulnerability Analysis

The vulnerability is an uncontrolled resource consumption issue classified as [CWE-400]. vLLM ships an audio upload path in AudioMediaIO that enforces decode-size and duration caps through VLLM_MAX_AUDIO_DECODE_DURATION_S and VLLM_MAX_AUDIO_DECODE_BYTES. The NanoNemotronVL video-to-audio extraction path does not enforce those same caps. This inconsistency creates a bypass: video-embedded audio reaches the decoder without size validation. Highly compressed audio streams expand dramatically after decoding into raw PCM samples, producing a memory amplification effect. See the GitHub Security Advisory GHSA-936p-m5pv-vvjf for the maintainer analysis.

Root Cause

The root cause is a missing parameter passthrough in _extract_audio_from_videos inside nano_nemotron_vl.py. The function invokes load_audio_pyav(BytesIO(video_bytes)) without forwarding the max_duration_s and max_decode_bytes arguments that gate other audio decode paths. Neither vLLM environment variable is consulted, so an operator cannot mitigate the issue through configuration alone.

Attack Vector

An attacker submits a small, highly compressed video file as multimodal input to a NanoNemotronVL model served with use_audio_in_video=True. During inference preprocessing, vLLM extracts the audio track and decodes it into raw sample buffers. Because the maximum decode size is not enforced, the resulting allocation can reach gigabytes from a payload of only a few kilobytes. Repeated or concurrent requests can quickly exhaust host memory and terminate the worker process. Additional context is available in the VulnCheck Denial of Service Advisory.

Detection Methods for CVE-2026-90554

Indicators of Compromise

Sudden memory growth in vLLM worker processes correlated with multimodal video requests to NanoNemotronVL endpoints.
Out-of-memory (OOM) kills or worker restarts recorded in vLLM server logs shortly after receiving video inputs.
Inbound requests containing small video payloads with disproportionately long audio tracks or high sample-rate encodings.

Detection Strategies

Instrument vLLM preprocessing to log the decoded audio buffer size returned by load_audio_pyav and alert when it exceeds expected thresholds.
Monitor container and pod memory metrics for spikes that coincide with /v1/chat/completions or multimodal inference endpoints.
Inspect request payloads at the API gateway for video attachments with unusual compression ratios relative to declared duration.

Monitoring Recommendations

Track process resident set size (RSS) and cgroup memory pressure on hosts serving NanoNemotronVL models.
Alert on repeated worker crashes or OOM events tied to the vLLM service in orchestrator logs.
Correlate multimodal request rates with GPU and CPU memory allocations in observability dashboards.

How to Mitigate CVE-2026-90554

Immediate Actions Required

Upgrade vLLM to version 0.28.0 or later, which enforces decode limits in the NanoNemotronVL video-to-audio path.
If upgrading is not immediately possible, disable use_audio_in_video on NanoNemotronVL model deployments.
Restrict access to inference endpoints so only authenticated clients can submit multimodal payloads.
Apply container-level memory limits so an OOM condition terminates a single worker rather than the host.

Patch Information

The issue is fixed in vLLM 0.28.0. Refer to the GitHub Security Advisory GHSA-936p-m5pv-vvjf for the corresponding commit and release notes.

Workarounds

Set use_audio_in_video=False when serving NanoNemotronVL models until the upgrade is deployed.
Front the vLLM API with a proxy that rejects video uploads above a configured byte size or duration.
Enforce strict cgroup or Kubernetes memory limits on vLLM worker pods to contain runaway allocations.

bash

# Configuration example
pip install --upgrade "vllm>=0.28.0"

# Temporary workaround: disable audio extraction from video input
vllm serve nvidia/NanoNemotronVL --use-audio-in-video false