A flaw was found in vLLM. An authenticated client can exploit this vulnerability by submitting forged FLAC (Free Lossless Audio Codec) headers with an inflated sample rate to the transcription endpoint. This bypasses duration checks, leading to excessive memory allocation within the API server process. The consequence is a Denial of Service (DoS), causing the API server to crash and affecting all tenants.

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.

vLLM versions before 0.28.0 fail to validate audio sample rate headers ...

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.