CVE-2026-115913

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mmaudio.py and phi4mmutils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forwardattenti...

CVE-2026-115913

Prior to version 0.32.0 , the vLLM inference and serving engine is vulnerable to a Denial of Service (DoS) condition via its Phi-4 multimodal audio encoder. Specifically, the components phi4mm_audio.py and phi4mm_utils.py use eager attention by default, causing MultiHeadedAttention.forward_attent...