{"items":[{"id":"NVI-00016053","kind":"vulnerability","title":"vLLM: Speech-to-text upload size limit is enforced after full UploadFile read","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-v82g-2437-67m2","CVE-2026-55646"],"plain_summary":"GitHub lists this reviewed advisory for vllm. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-5e4454d3c129d4b00b6a0f81e96f4312"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-17T17:16:19.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-101c0c207253565f6944a18f80914edb"},{"kind":"CVSS","as_of":"2026-10-25T20:10:00.147Z","value":"6.5 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-5e4454d3c129d4b00b6a0f81e96f4312"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-101c0c207253565f6944a18f80914edb","url":"https://github.com/advisories/GHSA-v82g-2437-67m2","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-v82g-2437-67m2","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T09:59:26.779Z"},{"id":"sr-5e4454d3c129d4b00b6a0f81e96f4312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55646","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-55646","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T01:48:26.418Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-101c0c207253565f6944a18f80914edb"],"technology":"vllm","known_exclusions":[],"conditions_summary":"## Summary\n\nCurrent-head vLLM documents `VLLM_MAX_AUDIO_CLIP_FILESIZE_MB` as the maximum audio file size accepted by the speech-to-text APIs. The default is 25 MB. `vllm/envs.py` also describes files larger than this value as rejected.\n\nThe `/v1/audio/transcriptions` and `/v1/audio/translations` routes call `await request.file.read()` before vLLM checks that limit. In FastAPI and Starlette, `UploadFile.read()` returns bytes from the uploaded file object; when called without a size argument, the route materializes the remaining file contents. vLLM then performs the compressed file-size check later in `_preprocess_speech_to_text()` against the already-created `bytes` object.\n\nAs a result, the documented compressed audio file-size limit does not bound the memory allocated by vLLM endpoint code before validation. An oversized multipart upload can cause vLLM to allocate memory proportional to the uploaded file size before rejecting the request as too large.\n\nThis is distinct from `GHSA-6pr9-rp53-2pmc`, which covered decoded PCM expansion after compressed input was accepted. This report covers compressed upload materialization before compressed-size validation.\n\n## Technical Details\n\nThe","public_affected_ranges":[">= 0.22.0, < 0.24.0"]}],"null_published_at":"2026-11-08T19:53:44.061Z","source_updated_at":"2026-07-17T17:16:19.000Z","source_disclosed_at":"2026-07-17T17:16:17.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-04T09:59:26.779Z"},{"id":"NVI-00016053","kind":"vulnerability","title":"vLLM: Speech-to-text upload size limit is enforced after full UploadFile read","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-v82g-2437-67m2","CVE-2026-55646"],"plain_summary":"GitHub lists this reviewed advisory for vllm. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-101c0c207253565f6944a18f80914edb"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-17T17:16:19.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-101c0c207253565f6944a18f80914edb"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-101c0c207253565f6944a18f80914edb","url":"https://github.com/advisories/GHSA-v82g-2437-67m2","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-v82g-2437-67m2","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T09:59:26.779Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-101c0c207253565f6944a18f80914edb"],"technology":"vllm","known_exclusions":[],"conditions_summary":"## Summary\n\nCurrent-head vLLM documents `VLLM_MAX_AUDIO_CLIP_FILESIZE_MB` as the maximum audio file size accepted by the speech-to-text APIs. The default is 25 MB. `vllm/envs.py` also describes files larger than this value as rejected.\n\nThe `/v1/audio/transcriptions` and `/v1/audio/translations` routes call `await request.file.read()` before vLLM checks that limit. In FastAPI and Starlette, `UploadFile.read()` returns bytes from the uploaded file object; when called without a size argument, the route materializes the remaining file contents. vLLM then performs the compressed file-size check later in `_preprocess_speech_to_text()` against the already-created `bytes` object.\n\nAs a result, the documented compressed audio file-size limit does not bound the memory allocated by vLLM endpoint code before validation. An oversized multipart upload can cause vLLM to allocate memory proportional to the uploaded file size before rejecting the request as too large.\n\nThis is distinct from `GHSA-6pr9-rp53-2pmc`, which covered decoded PCM expansion after compressed input was accepted. This report covers compressed upload materialization before compressed-size validation.\n\n## Technical Details\n\nThe","public_affected_ranges":[">= 0.22.0, < 0.24.0"]}],"null_published_at":"2026-11-04T10:04:27.870Z","source_updated_at":"2026-07-17T17:16:19.000Z","source_disclosed_at":"2026-07-17T17:16:17.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T09:59:26.779Z"}],"next_cursor":null,"snapshot_revision":"42594"}