CyberRota Analysis
AI-GeneratedThe vulnerability affects versions 0.22.0 to 0.23.0 of vLLM, specifically in the /v1/audio/transcriptions and /v1/audio/translations routes, where oversized audio files can be uploaded without immediate size validation. This can lead to excessive memory allocation, potentially causing memory pressure or process termination, which impacts the stability of applications using vLLM. Organizations utilizing vLLM for audio processing should prioritize upgrading to version 0.24.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/translations routes call request.file.read() to fully materialize an uploaded audio file into memory before vLLM checks the documented VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed upload size limit (default 25 MB) later in the speech-to-text preprocessing step, so an API caller who can reach those routes can submit an oversized multipart upload and cause vLLM to allocate memory proportional to the uploaded file size before the request is rejected as too large, creating memory pressure or terminating the process depending on deployment resource limits. This issue is fixed in version 0.24.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)