CVE-2026-114052

vLLM MOSS-Audio can retain a new processor for each client configuration

vLLM · MOSS-Audio tokenization

First documented disclosure · Review checkpoint

Summary

Repeated tokenization requests can grow a frontend’s memory footprint for the lifetime of the process.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: Controlled tests demonstrate retained allocations. A malicious incident or actual out-of-memory shutdown was not verified.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A request can control audio processor settings used as keys in a private cache. Each unique configuration can retain a processor with allocated filter arrays, and large dimensions increase the allocation.

Conditions required

A reachable /tokenize route on an instance serving MOSS-Audio. vLLM’s built-in API key alone does not cover this route.

Potential impact

Progressive memory exhaustion or loss of the frontend. Researchers measured controlled allocations and did not execute their largest destructive example.

Affected versions and configurations

vLLM lists versions after 0.24.0 and before 0.31.0. VulnCheck identifies 0.25.0 as the first affected release.

Fix and mitigation status

0.31.0 per the maintainer advisory. The underlying tagged processor still contains a cache, so deployments should separately verify that untrusted overrides are rejected.

Practical next steps

Upgrade to a fixed release, protect /tokenize at the proxy and verify that requests cannot supply arbitrary processor construction parameters.

Operating lesson

Bound the number and size of cached objects that remote requests can create outside the normal inference route.

Evidence and limits

The October 6 advisory supplies the first issue-specific public disclosure located. The October 21 CNA is later. Operators should preserve controls on the auxiliary endpoint even when inference is authenticated.

Sources