CVE-2026-57173: vLLM unbounded audio decode causes

Q: Is CVE-2026-57173 actively exploited?

No confirmed active exploitation of CVE-2026-57173 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-57173?

1) Upgrade vLLM to 0.24.0 or later (fix in PR #45908). 2) If patching is delayed, place vLLM behind an authenticating gateway or API proxy, limit request body size and per-client rate, and block input_audio content parts for clients that do not need audio. 3) Where possible, serve audio models in separate instances from text-only workloads to contain crashes. 4) Set container memory limits and automatic restarts with health checks so a crash does not become prolonged downtime. 5) Detect: alert on repeated worker OOM kills, unusual restarts, and requests to /v1/chat/completions containing input_audio with large or data-URL payloads. 6) Inventory all vLLM deployments, including those embedded in other platforms, to confirm versions.

Q: What systems are affected by CVE-2026-57173?

This vulnerability affects the following AI/ML architecture patterns: Model serving, LLM inference endpoints, Multimodal/audio LLM deployments, OpenAI-compatible API gateways, Multi-tenant inference platforms.

Q: What is the CVSS score for CVE-2026-57173?

CVE-2026-57173 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.73%.

CISO Take

CVE-2026-57173 lets any authenticated low-privilege client crash a vLLM worker by sending a small compressed audio clip to /v1/chat/completions that decodes into a huge float32 PCM allocation, because the audio duration guard used on the transcription endpoint was never applied to this path. The blast radius is real but bounded to availability: vLLM has 95 downstream dependents and 145 other tracked CVEs, yet there is no confidentiality or integrity impact, no public exploit, no Nuclei template, and it is not in CISA KEV. EPSS is low (0.0073, top 47%) and CISA SSVC says TRACK, so this is a scheduled-patching item, not an emergency. Only deployments serving an audio-capable model are exposed, but if your inference endpoint is internet-facing or shared across tenants, a single request can take down GPU capacity. Upgrade to vLLM 0.24.0 or later, and until then restrict network access to the API and cap request body sizes at your gateway.

Sources:NVDGitHub AdvisoryEPSSATLASvllm-project/vllm GitHub

What is the risk?

Medium (CVSS 6.5, A:H only). Exploitation is trivial once the endpoint is reachable (low complexity, no user interaction), but the precondition of an audio-capable model and low privileges limits exposure. EPSS 0.0073 and the absence of public exploits or KEV listing indicate low near-term exploitation likelihood. The main risk is repeatable service outage and GPU worker restarts in shared or multi-tenant inference platforms.

How does the attack unfold?

Initial Access

Attacker authenticates with a low-privilege credential, or reaches an unauthenticated deployment, exposing /v1/chat/completions on an audio-capable vLLM model.

AML.T0040

Exploitation

Attacker submits a small compressed input_audio payload, often as an inline data URL, that bypasses the decode duration guard.

AML.T0034.001

Resource Exhaustion

The decoder expands the audio into a very large float32 PCM buffer, exhausting memory on the worker.

Impact

The vLLM worker crashes with an out-of-memory error, and repeated requests keep the inference service unavailable.

AML.T0029

Initial Access

Attacker authenticates with a low-privilege credential, or reaches an unauthenticated deployment, exposing /v1/chat/completions on an audio-capable vLLM model.

AML.T0040

Exploitation

Attacker submits a small compressed input_audio payload, often as an inline data URL, that bypasses the decode duration guard.

AML.T0034.001

Resource Exhaustion

The decoder expands the audio into a very large float32 PCM buffer, exhausting memory on the worker.

Impact

The vLLM worker crashes with an out-of-memory error, and repeated requests keep the inference service unavailable.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	<= 0.23.0	`0.24.0`
96.0K94 dependentsPushed 5d ago27% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 54% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade vLLM to 0.24.0 or later (fix in PR #45908). 2) If patching is delayed, place vLLM behind an authenticating gateway or API proxy, limit request body size and per-client rate, and block input_audio content parts for clients that do not need audio. 3) Where possible, serve audio models in separate instances from text-only workloads to contain crashes. 4) Set container memory limits and automatic restarts with health checks so a crash does not become prolonged downtime. 5) Detect: alert on repeated worker OOM kills, unusual restarts, and requests to /v1/chat/completions containing input_audio with large or data-URL payloads. 6) Inventory all vLLM deployments, including those embedded in other platforms, to confirm versions.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSInferenceAPIAML.T0029- Denial of AI Service AML.T0034.001- Resource-Intensive Queries AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to unknown risks and system failures

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-57173?

CVE-2026-57173 lets any authenticated low-privilege client crash a vLLM worker by sending a small compressed audio clip to /v1/chat/completions that decodes into a huge float32 PCM allocation, because the audio duration guard used on the transcription endpoint was never applied to this path. The blast radius is real but bounded to availability: vLLM has 95 downstream dependents and 145 other tracked CVEs, yet there is no confidentiality or integrity impact, no public exploit, no Nuclei template, and it is not in CISA KEV. EPSS is low (0.0073, top 47%) and CISA SSVC says TRACK, so this is a scheduled-patching item, not an emergency. Only deployments serving an audio-capable model are exposed, but if your inference endpoint is internet-facing or shared across tenants, a single request can take down GPU capacity. Upgrade to vLLM 0.24.0 or later, and until then restrict network access to the API and cap request body sizes at your gateway.

Is CVE-2026-57173 actively exploited?

No confirmed active exploitation of CVE-2026-57173 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57173?

1) Upgrade vLLM to 0.24.0 or later (fix in PR #45908). 2) If patching is delayed, place vLLM behind an authenticating gateway or API proxy, limit request body size and per-client rate, and block input_audio content parts for clients that do not need audio. 3) Where possible, serve audio models in separate instances from text-only workloads to contain crashes. 4) Set container memory limits and automatic restarts with health checks so a crash does not become prolonged downtime. 5) Detect: alert on repeated worker OOM kills, unusual restarts, and requests to /v1/chat/completions containing input_audio with large or data-URL payloads. 6) Inventory all vLLM deployments, including those embedded in other platforms, to confirm versions.

What systems are affected by CVE-2026-57173?

This vulnerability affects the following AI/ML architecture patterns: Model serving, LLM inference endpoints, Multimodal/audio LLM deployments, OpenAI-compatible API gateways, Multi-tenant inference platforms.

What is the CVSS score for CVE-2026-57173?

CVE-2026-57173 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.73%.

What is the AI security impact?

Affected AI Architectures

Model servingLLM inference endpointsMultimodal/audio LLM deploymentsOpenAI-compatible API gatewaysMulti-tenant inference platforms

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0034.001Resource-Intensive Queries

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v1/chat/completions calls AudioMediaIO.load_bytes or AudioMediaIO.load_file without passing VLLM_MAX_AUDIO_DECODE_DURATION_S to the shared audio decoder. An unauthenticated client can therefore submit a small compressed audio input that expands into a very large float32 PCM allocation, bypassing the duration guard already used by /v1/audio/transcriptions and causing an out-of-memory worker crash. Inline data URLs reach this path without being bounded by VLLM_AUDIO_FETCH_TIMEOUT. The issue affects deployments serving an audio-capable model, and authentication changes only the deployment-specific reachability. This issue is fixed in version 0.24.0.

Exploitation Scenario

An attacker with a basic API key for a shared internal or SaaS LLM gateway discovers that the backend runs an audio-capable model on vLLM. They send a small, highly compressed audio file as a base64 data URL in an input_audio message to /v1/chat/completions. The server decodes it into a multi-gigabyte float32 buffer without duration limits, exhausting memory and killing the worker. By repeating the request whenever the worker restarts, the attacker keeps the inference service unavailable for all tenants.

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or ThrottlingPrimary CWE-770Allocation of Resources Without Limits or ThrottlingPrimary CWE-770Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.