6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54233

CVE-2026-54233: vLLM: OOM Denial of Service via Audio Decompression Bomb

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, vLLM's /v1/audio/transcriptions endpoint limits compressed upload size but not decoded PCM output. A 25MB OPUS file expands to ~14.9GB of float32 PCM at decode time. This vulnerability is fixed in 0.23.1rc0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54233

CVE-2026-54233:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vllm	pip	<= 0.23.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial-of-service (DoS) caused by a data amplification attack, commonly known as a 'decompression bomb'. The application's /v1/audio/transcriptions endpoint checks the size of the uploaded compressed audio file but fails to limit the size of the audio after it is decompressed. An attacker can upload a small, specially crafted audio file (e.g., a low-bitrate OPUS file) that expands to a very large size in memory during decoding.

The analysis of the patch commit 1b1359c33269446f13c05da9a90c25174cbea590 reveals the exact functions involved. The vulnerability is triggered in SpeechToTextProcessor._preprocess_speech_to_text, which reads the uploaded audio and calls load_audio. The load_audio function, in turn, uses either load_audio_pyav or load_audio_soundfile to perform the decoding. In the vulnerable version, these decoding functions would read and process the entire audio stream into memory without any limits. The load_audio_pyav function is particularly illustrative, as it iteratively appends decoded chunks into a list, which is then concatenated into a single, massive memory allocation.

The fix introduces a new configuration parameter, max_duration_s, which is passed down from the entry point to the decoding functions. This parameter is used to check the audio's duration, both from its metadata and during the decoding process itself, causing the operation to fail early if the limit is exceeded. This prevents the excessive memory allocation that leads to the DoS.

Vulnerable functions

SpeechToTextProcessor._preprocess_speech_to_text

vllm/entrypoints/speech_to_text/base/serving.py

This method is the entry point for processing the uploaded audio file. It calls `load_audio` without any limits on the decoded audio size, initiating the decompression bomb.

load_audio

vllm/multimodal/media/audio.py

This function orchestrates the audio loading by calling backend-specific functions like `load_audio_pyav`. It was vulnerable because it lacked a mechanism to limit the duration of the audio being decoded, allowing for excessive memory allocation.

load_audio_pyav

vllm/multimodal/media/audio.py

This function decodes the audio stream frame by frame using the PyAV library. The vulnerability lies in the loop where it appends decoded audio chunks to a list in memory without any size or duration checks. This allows a highly compressed audio file to expand and consume a large amount of memory, leading to a denial of service.

load_audio_soundfile

vllm/multimodal/media/audio.py

This function, an alternative to `load_audio_pyav`, reads the entire audio file into memory using the `soundfile` library. It was vulnerable because it did not check the audio's duration before reading, allowing a large decompressed file to exhaust system memory.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.