CVE-2026-123748

Idle voice sessions could continue occupying grok2api capacity

chenyme / grok2api · grok2api voice and speech-to-text proxy

First documented disclosure · Review checkpoint

Summary

A voice session could keep a concurrency slot and upstream resources after its configured time limit.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources describe the vulnerability and its conditions. They do not identify malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The voice proxy did not release an admitted session when the request timed out.

Conditions required

The affected service accepts voice or speech-to-text sessions and has a limited pool of concurrent sessions.

Potential impact

Legitimate requests could lose access to limited session capacity.

Affected versions and configurations

VulDB lists 3.1.0 through 3.1.6.

Fix and mitigation status

3.1.7.

Practical next steps

Upgrade to 3.1.7 and check that idle voice sessions release their capacity after timeout.

Operating lesson

Tie resource leases to the lifetime of the request that acquired them.

Evidence and limits

The upstream issue concerns resource retention. It does not identify customer downtime.

Sources