CVE-2026-57173

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published

Aug 23, 2026, 10:00:00 PM UTC

Updated

Sep 16, 2026, 5:17:24 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.73% · Oct 25, 2026

A flaw was found in vLLM, an inference and serving engine for large language models. An unauthenticated client can exploit this by submitting a small, compressed audio input that expands into a very large memory allocation. This bypasses existing duration guards, leading to an out-of-memory condition and causing a worker crash. This vulnerability results in a Denial of Service (DoS) for deployments serving audio-capable models. vllm: vLLM: Denial of Service via unauthenticated audio decompression This Moderate impact denial of service flaw in vLLM affects Red Hat AI Inference Server, Red Hat OpenShift AI, and Red Hat Enterprise Linux AI when configured to serve audio-capable models. An unauthenticated attacker could provide a specially crafted compressed audio input, leading to excessive memory allocation and a service crash. This risk is present in deployments where audio processing is enabled, regardless of authentication status. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.