CVE-2026-116175: vLLM: audio decompression bomb exhausts server memory

vLLM versions 0.19.0 up to (but not including) 0.24.0 fail to enforce a decoded-duration limit when processing audio sent through the multimodal path, so a small compressed audio file can expand into huge decoded PCM data and exhaust server memory. Any authenticated user, including holders of a low-privilege API key, can trigger an out-of-memory denial of service against the /v1/chat/completions endpoint with a single crafted request. The CVSS score is a moderate 6.5, with availability impact only (no confidentiality or integrity loss), and there is no known public exploit, no Nuclei template, no KEV listing and no EPSS data, so near-term mass exploitation looks unlikely. Shared or multi-tenant inference gateways and any deployment that issues API keys to external parties or customers carry the highest exposure, since one request could take down GPU serving capacity for everyone. Upgrade to vLLM 0.24.0 or later, and until then restrict audio inputs or enforce request size and rate limits at the gateway.

No confirmed active exploitation of CVE-2026-116175 has been reported, but organizations should still patch proactively.

1) Upgrade vLLM to 0.24.0 or later, which applies the max_duration_s decoded-duration limit in the AudioMediaIO path. 2) If you cannot patch immediately, block or strip input_audio and audio_url content at an API gateway or reverse proxy, or disable audio modalities for models that do not need them. 3) Enforce per-key rate limits, request body size caps and audio payload size caps, and restrict which clients get API keys. 4) Set container and process memory limits and use automatic restart with health checks so an OOM event does not become a prolonged outage. 5) Where audio_url is allowed, restrict fetchable domains and limit download size. 6) Detection: alert on sudden memory spikes in vLLM workers, OOM-kill events, and repeated /v1/chat/completions requests carrying audio content from a single key, then review the GHSA-r45p-7qwx-qwjw advisory for the full fix details.

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference APIs, multimodal pipelines, voice-enabled assistants, multi-tenant LLM gateways.

CVE-2026-116175 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.31%.