CVE-2026-55646

vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/translations routes call request.file.read() to fully materialize an uploaded audio file into memory before vLLM checks the documented VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed upload size limit (default 25 MB) later in the speech-to-text preprocessing step, so an API caller who can reach those routes can submit an oversized multipart upload and cause vLLM to allocate memory proportional to the uploaded file size before the request is rejected as too large, creating memory pressure or terminating the process depending on deployment resource limits. This issue is fixed in version 0.24.0.

• CWE-400
• CWE-770

• https://github.com/vllm-project/vllm/commit/b997071ec493765abbed990c65843ed05e4708a8Patch
• https://github.com/vllm-project/vllm/pull/45510Issue Tracking, Patch
• https://github.com/vllm-project/vllm/security/advisories/GHSA-v82g-2437-67m2Vendor Advisory
• https://github.com/vllm-project/vllm/security/advisories/GHSA-v82g-2437-67m2Vendor Advisory

Published

Jul 6, 2026

Last Modified

Jul 7, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55635DataEase is an open source data visualization and analysis t…8.7
• CVE-2026-556389Router is an AI router & token saver. Prior to 0.5.2, 9rout…8.6
• CVE-2026-55639xrdp is an open source RDP server. Versions 0.10.6 and prior…5.3
• CVE-2026-5564A weakness has been identified in code-projects Simple Laund…7.3
• CVE-2026-556419Router is an AI router & token saver. Prior to 0.5.2, 9rout…8.2
• CVE-2026-55645xrdp is an open source RDP server. Versions 0.10.6 and prior…6.5
• CVE-2026-55647DataEase is an open source data visualization and analysis t…5.1
• CVE-2026-5565A security vulnerability has been detected in code-projects …7.3
• CVE-2026-55651Easy!Appointments is a self hosted appointment scheduler. In…7.1
• CVE-2026-55652Wekan is open source kanban built with Meteor. Prior to 9.46…9.8
• CVE-2026-55653A flaw was found in OpenSSH. A malicious SSH server can expl…6.5
• CVE-2026-55654A flaw was found in OpenSSH. This vulnerability, a heap out-…3.7