CVE-2026-55646

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55646
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55646.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55646
Aliases
Downstream
Published
2026-07-06T19:41:11.330Z
Modified
2026-08-07T11:51:24.712028328Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit
Details

vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/translations routes call request.file.read() to fully materialize an uploaded audio file into memory before vLLM checks the documented VLLMMAXAUDIOCLIPFILESIZE_MB compressed upload size limit (default 25 MB) later in the speech-to-text preprocessing step, so an API caller who can reach those routes can submit an oversized multipart upload and cause vLLM to allocate memory proportional to the uploaded file size before the request is rejected as too large, creating memory pressure or terminating the process depending on deployment resource limits. This issue is fixed in version 0.24.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55646.json",
    "cwe_ids": [
        "CWE-400",
        "CWE-770"
    ]
}
References

Affected packages

Git / github.com/vllm-project/vllm

Affected ranges

Type
GIT
Repo
https://github.com/vllm-project/vllm
Events
Introduced
0b3ba88f165976e77ca5e6a7a3f5bba4562b80af
Fixed
217c64a976869883fcf0c52a8cf8bc3c954d285b
Fixed
b997071ec493765abbed990c65843ed05e4708a8
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.22.0"
        },
        {
            "fixed": "0.24.0"
        }
    ],
    "cpe": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55646.json"