CVE-2026-100648CWE-400denial-of-service

CVE-2026-100648

Medium · published September 26, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decoding.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00351 · 27.6th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-09-26T18:16Z
Affected products (1)
ProductVersionsFixed in
vllm/vllm< 0.29.00.29.0
References (2)
https://github.com/vllm-project/vllm/security/advisories/GHSA-jcq2-4gch-5qhf · [email protected]https://www.vulncheck.com/advisories/vllm-before-0.29.0-uncontrolled-resource-consumption-via-audio-decoding · [email protected]
EPSS history
Timeline
  • 28 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 26 SEP 13:23Z
    vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding
    cvelistv5