PyPI/vllm CVE-2026-100650: medium 6.5, EPSS 0.81%
vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB,
Action: Upgrade vllm to 0.30.0 or later.
pip install vllm==0.30.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.30.0 | - |
Fixed versions
| 0.30.0 |
Sources
- osv: PYSEC-2026-4184
- nvd: CVE-2026-100650
- https://www.vulncheck.com/advisories/vllm-before-0.29.0-resource-exhaustion-via-unbounded-media-materialization
- https://github.com/vllm-project/vllm/commit/752a3a504485790a2e8491cacbb35c137339ad34
- https://github.com/vllm-project/vllm/security/advisories/GHSA-p6g9-7v3x-m8mv
CVE-2026-100650 · published · modified · JSON