Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-116175

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio via input_audio or audio_url in /v1/chat/completions requests that expands to huge decoded PCM, exhausting server memory.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 23.4%
CVSS Severity
CVSS v3 Score 6.5
Products affected by CVE-2026-116175
  • Vllm » Vllm » Version: 0.19.0
    cpe:2.3:a:vllm:vllm:0.19.0
  • Vllm » Vllm » Version: 0.19.1
    cpe:2.3:a:vllm:vllm:0.19.1
  • Vllm » Vllm » Version: 0.19.2
    cpe:2.3:a:vllm:vllm:0.19.2
  • Vllm » Vllm » Version: 0.20.0
    cpe:2.3:a:vllm:vllm:0.20.0
  • Vllm » Vllm » Version: 0.20.1
    cpe:2.3:a:vllm:vllm:0.20.1
  • Vllm » Vllm » Version: 0.20.2
    cpe:2.3:a:vllm:vllm:0.20.2
  • Vllm » Vllm » Version: 0.21.0
    cpe:2.3:a:vllm:vllm:0.21.0
  • Vllm » Vllm » Version: 0.21.1
    cpe:2.3:a:vllm:vllm:0.21.1
  • Vllm » Vllm » Version: 0.22.0
    cpe:2.3:a:vllm:vllm:0.22.0
  • Vllm » Vllm » Version: 0.22.1
    cpe:2.3:a:vllm:vllm:0.22.1
  • Vllm » Vllm » Version: 0.23.0
    cpe:2.3:a:vllm:vllm:0.23.0
  • Vllm » Vllm » Version: 0.23.1
    cpe:2.3:a:vllm:vllm:0.23.1


Products
Pricing
Contact Us

Shodan ® - All rights reserved