CVE-2026-54233: vLLM Audio Transcription Denial of Service (CVSS 6.5)

Technical summary

CVE-2026-54233 exploits insufficient resource validation in vLLM's /v1/audio/transcriptions endpoint. While the endpoint enforces size limits on the compressed upload payload, it lacks corresponding limits on the decoded PCM output. An attacker with valid credentials can craft a request containing a highly compressed OPUS audio file. Upon server-side decompression, the output expands far beyond the original upload size constraint, resulting in uncontrolled memory allocation. This memory exhaustion triggers an availability impact, effectively denying service to legitimate requests. The vulnerability is rooted in CWE-409 (Improper Restriction of Rendered UI Layers or Frames), though the root cause is resource exhaustion rather than UI-specific issues.

Business impact

Organizations deploying vLLM for audio transcription services face potential service disruption. An authenticated attacker can trigger denial-of-service conditions by repeatedly uploading compressed files, making the transcription endpoint unavailable to legitimate users. This is particularly concerning for production deployments relying on vLLM for customer-facing or mission-critical speech-to-text functionality. Recovery requires manual intervention or service restart, leading to downtime and operational disruption. While authentication is required, compromised or malicious internal accounts, or integration scenarios with untrusted clients, pose a credible threat.

Affected systems

vLLM versions prior to 0.23.1rc0 are vulnerable. Organizations should audit their vLLM deployment versions immediately. The vulnerability is specific to the /v1/audio/transcriptions endpoint; deployments not exposing this endpoint or using vLLM purely for text-based LLM inference may have reduced exposure, though this should be verified against your specific configuration.

Exploitability

Exploitation requires valid authentication credentials to access the endpoint, which limits casual or opportunistic attacks. However, the attack is trivial to execute once authenticated—no specialized tools or complex manipulation are required, only the ability to craft a POST request with a compressed audio file. The attack is deterministic and reliable; a 25 MB OPUS file will consistently trigger the vulnerability on vulnerable versions. In environments where API access is broadly granted or where service accounts have weak credential management, the barrier to exploitation is minimal.

Remediation

Upgrade vLLM to version 0.23.1rc0 or later. This release includes fixes that enforce resource limits on decoded output, preventing uncontrolled memory expansion. Review the vLLM release notes for that version to confirm the fix addresses this specific endpoint. Additionally, implement network-level and application-level rate limiting on the /v1/audio/transcriptions endpoint to mitigate potential abuse, and restrict access to this endpoint to trusted clients only using authentication and authorization controls.

Patch guidance

Apply the upgrade to vLLM 0.23.1rc0 or a later stable release. Verify compatibility with your current Python environment and any dependent services before upgrading production instances. Test the patched version against your audio transcription workloads to ensure no regressions. If you are currently on a version significantly older than 0.23.1, check the vLLM release notes for any breaking changes or additional security fixes included in intervening releases. Plan the upgrade during a maintenance window to avoid service disruption.

Detection guidance

Monitor server memory usage patterns on instances running the /v1/audio/transcriptions endpoint. Sudden spikes in memory consumption following audio upload requests may indicate exploitation attempts. Log and alert on repeated failed allocations or out-of-memory errors originating from the audio transcription service. Review authentication logs for access to this endpoint, particularly from unexpected or suspicious accounts. Network IDS/IPS rules can be configured to detect unusually large memory allocations or process crashes on vLLM services following transcription requests, though signature-based detection is limited without application-level visibility.

Why prioritize this

Although the CVSS score is moderate (6.5/MEDIUM), the vulnerability warrants prompt attention due to the ease of exploitation and guaranteed availability impact. Any authenticated user can reliably crash the service with a single request. For organizations heavily dependent on vLLM for audio transcription or running vLLM in a multi-tenant or semi-trusted environment, this represents a credible and practical threat. The fix is mature (released in 0.23.1rc0) and does not appear to be experimental, making remediation straightforward. Prioritize patching over defensive measures alone.

Risk score, explained

The CVSS v3.1 score of 6.5 reflects the vulnerability's profile: network-accessible endpoint, low attack complexity, requirement for low-privileged authentication, and guaranteed availability impact. The severity is MEDIUM rather than HIGH because confidentiality and integrity are unaffected; the impact is strictly denial of service. The requirement for valid credentials prevents unauthenticated exploitation, reducing the overall score. However, in real-world deployments where credentials are shared, weak, or overly permissive, the practical risk may exceed the CVSS rating.

Frequently asked questions