Allocation of Resources Without Limits or Throttling in vLLM - CVE-2026-55646

Detailed vulnerability description

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the speech-to-text upload handling routes when processing oversized audio file uploads. A remote user can send a specially crafted oversized multipart upload to cause a denial of service.

Exploitation requires that the deployment exposes the speech-to-text endpoints and has a speech-to-text capable model or task configured.

How to mitigate CVE-2026-55646

Sources

• https://github.com/vllm-project/vllm/security/advisories/GHSA-v82g-2437-67m2
• https://github.com/vllm-project/vllm/security/advisories/GHSA-6pr9-rp53-2pmc