CVE-2026-54233
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, vLLM's /v1/audio/transcriptions endpoint limits compressed upload size but not decoded PCM output. A 25MB OPUS file expands to ~14.9GB of float32 PCM at decode time. This vulnerability is fixed in 0.23.1rc0.
- Affected products
- Vllm
- Vllm
- < 0.23.1
- Fix
- Available
- CVSS 3.1
- 6.5 MEDIUM
- EPSS
- 0.4% (35th percentile)
- Weakness
- CWE-409
- NVD status
- Analyzed
- Published
- 2026-06-22
CVE-2026-54233 at NVD
No indexed exploits for CVE-2026-54233 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-54233 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.