LLMMedium
CVE-2026-54233: vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, vLLM's…
- Occurred
- Jun 22, 2026
- Published
- Jun 22, 2026
- Source
- NVD CVE
Summary
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, vLLM's /v1/audio/transcriptions endpoint limits compressed upload size but not decoded PCM output. A 25MB OPUS file expands to ~14.9GB of float32 PCM at decode time. This vulnerability is fixed in 0.23.1rc0.
Tags
- CVE
- CVE-2026-54233
- cvss:MEDIUM
Classification
Category confidence: 95%
Severity confidence: 90%
Rationale: vLLM LLM serving engine vulnerability allows resource exhaustion via audio input expansion.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8