{
 "id": "AIR-2026-0140",
 "slug": "cve-2026-57173-vllm-audio-input-handling-out-of-memory-flaw",
 "title": "CVE-2026-57173: vLLM audio input handling out-of-memory flaw",
 "summary": "Prior to version 0.24.0, vLLM's chat completions audio handling path fails to enforce duration guards on loaded audio files. Attackers can submit compressed audio that expands to crash worker processes via out-of-memory errors.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "vLLM"
 ],
 "incident_date": "2026-09-16",
 "incident_date_precision": "day",
 "first_reported": "2026-09-16",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57173",
   "publisher": "NVD",
   "title": "CVE-2026-57173: vLLM is an inference and serving engine for large language models.",
   "published_at": "2026-09-16"
  },
  {
   "url": "https://github.com/advisories/GHSA-hcwq-8wjf-3gcr",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-57173: vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions",
   "published_at": "2026-09-16"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-57173",
  "vllm",
  "dos"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T07:00:14.101Z"
}