Improper Handling of Highly Compressed Data (Data Amplification)

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the AudioMediaIO multimodal path, which calls loadaudio without passing a...

CVE-2026-116175

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls loadaudio without the maxdurations decoded-duration limit. Authenticated attackers can send small compressed audio via inputaudio or audiourl in /v1/chat/completions requests...

CVE-2026-116175 vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls loadaudio without the maxdurations decoded-duration limit. Authenticated attackers can send small compressed audio via inputaudio or audiourl in /v1/chat/completions requests...

CVE-2026-116175

The vLLM framework versions 0.19.0 through 0.24.0 are vulnerable to an Audio Decompression Bomb (CWE-409). The root cause is that the AudioMediaIO multimodal path calls load_audio without enforcing the max_duration_s decoded-duration limit. This allows authenticated attackers to submit small, hig...

CVE-2026-116175 vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls loadaudio without the maxdurations decoded-duration limit. Authenticated attackers can send small compressed audio via inputaudio or audiourl in /v1/chat/completions requests...

CVE-2026-116175

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls loadaudio without the maxdurations decoded-duration limit. Authenticated attackers can send small compressed audio via inputaudio or audiourl in /v1/chat/completions requests...

vLLM resource management error vulnerability

Versions vLLM 0.19.0 through 0.24.0 contain a resource management error vulnerability. This vulnerability arises because the AudioMediaIO multimodal path fails to set a maxdurations limit for decoding duration when calling loadaudio. Authenticated attackers can exploit this by submitting small...

SUSE CVE-2026-109226

SGLang through 0.5.21 contains a decompression amplification vulnerability in loadaudio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audiourl or audioda...

CVE-2026-109226

SGLang through 0.5.21 contains a decompression amplification vulnerability in loadaudio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audiourl or audioda...

CVE-2026-109226 SGLang through 0.5.21 Audio Decompression Amplification via load_audio

SGLang through 0.5.21 contains a decompression amplification vulnerability in loadaudio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audiourl or audioda...

CVE-2026-109226

SGLang versions through 0.5.21 are vulnerable to a decompression amplification vulnerability within the load_audio function. This flaw allows remote attackers to trigger a denial of service (DoS) by submitting highly compressed, small FLAC-encoded silence files via audio_url or audio_data inputs....

CVE-2026-109226

SGLang through 0.5.21 contains a decompression amplification vulnerability in loadaudio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audiourl or audioda...

CVE-2026-109226 SGLang through 0.5.21 Audio Decompression Amplification via load_audio

SGLang through 0.5.21 contains a decompression amplification vulnerability in loadaudio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audiourl or audioda...

EUVD-2026-97432

SGLang through 0.5.21 contains a decompression amplification vulnerability in loadaudio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audiourl or audioda...

CVE-2026-109226 SGLang through 0.5.21 Audio Decompression Amplification via load_audio

SGLang through 0.5.21 contains a decompression amplification vulnerability in loadaudio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audiourl or audioda...

CVE-2026-109226: Improper Handling of Highly Compressed Data (Data Amplification)

SGLang through 0.5.21 contains a decompression amplification vulnerability in loadaudio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audiourl or audioda...