Read the docs
TI-2026-80505 Aliases CVE-2026-115913GHSA-8397-8qf6-f2gm

Memory exhaustion in vLLM Phi-4 audio encoder crashes engine

Priority LOW 29CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

vLLM versions before 0.32.0 are affected. The Phi-4 multimodal audio encoder uses eager attention by default, so it materializes and retains full attention matrices, which causes quadratic GPU memory use (CWE-770). A remote attacker with low privileges can submit one legal long audio clip that exhausts GPU memory and terminates EngineCore for all users. An exploit link is listed in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forward_attention to materialize and retain full attention matrices in self.attn. The scaled dot-product attention branch does not materialize these matrices. The resulting quadratic GPU-memory use can cause an out-of-memory condition and terminate EngineCore for all users. This issue is fixed in version 0.32.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00329 26th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed vllm (vllm-project): 0.32.0vllm (PyPI): 0.32.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vllm-projectvllmbefore 0.32.00.32.0Patch availableCNA
—vllm (PyPI)before 0.32.00.32.0Patch availableGHSA-8397-8qf6-f2gm
  • vllm Vendorvllm-project Affected before 0.32.0 Fixed in 0.32.0 Patch available CNA
  • vllm (PyPI) Vendor— Affected before 0.32.0 Fixed in 0.32.0 Patch available GHSA-8397-8qf6-f2gm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*0.31.0 to before 0.32.0VulnerablevLLM
  • cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:* Versions 0.31.0 to before 0.32.0 Vulnerable ·vLLM

Remediation

Upgrade the PyPI package vllm to version 0.32.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA vllm (vllm-project) Fixed in 0.32.0
  • Fix · GHSA-8397-8qf6-f2gm vllm (PyPI) Fixed in 0.32.0 Advisory →

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-115913
  2. 2026-10-27 Priority changed: MEDIUM → LOW
  3. 2026-10-28 Alias added: GHSA-8397-8qf6-f2gm
  4. 2026-10-28 Fix available: PyPI/[email protected] · GHSA-8397-8qf6-f2gm
  5. 2026-10-28 CVSS score added · GHSA-8397-8qf6-f2gm
  6. 2026-10-28 Weakness changed · GHSA-8397-8qf6-f2gm
  7. 2026-10-28 6 new references · GHSA-8397-8qf6-f2gm
  8. 2026-11-02 CISA SSVC decision points changed

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2024-10229 Remote Code Execution in vllm-project/vllm CVSS 3.0CRITICAL 9.8
  • TI-2024-08404 Remote Code Execution in vllm-project/vllm CVSS 3.1CRITICAL 9.8
  • TI-2026-36017 vLLM: OpenAI auth bypass CVSS 3.1CRITICAL 9.1
  • TI-2026-63056 vLLM before 0.28.0 Denial of Service via negative token ID CVSS 4.0HIGH 8.7
  • TI-2026-04308 Hardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security Control CVSS 3.0HIGH 8.8
  • TI-2026-39137 vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection CVSS 3.1HIGH 7.5
See all 124 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences