Medium severity5.3NVD Advisory· Published Sep 26, 2026

CVE-2026-100648

Description

vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decoding.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Vllm/Vllmllm-create
Range: <0.29.0

Patches

Vulnerability mechanics

References

github.com/vllm-project/vllm/security/advisories/GHSA-jcq2-4gch-5qhfnvd
www.vulncheck.com/advisories/vllm-before-0.29.0-uncontrolled-resource-consumption-via-audio-decodingnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000