CVE-2026-114052

The vLLM framework (versions after 0.24.0 and before 0.31.0) contains a memory exhaustion vulnerability within the MOSS-Audio model serving component. The root cause is the use of an unbounded dictionary that caches a processor for every unique request-controlled mm_processor_kwargs value. Unauth...

EUVD-2026-107003

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mmprocessorkwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized melconfig values to...