CVE-2026-55646: 
NixOS vulnerability analysis and mitigation

CVE-2026-55646 is a Denial of Service vulnerability in vLLM, an inference and serving engine for large language models, caused by an audio upload size limit being enforced after full file materialization in memory. Affecting vLLM versions 0.22.0 through 0.23.0 (inclusive), the flaw was published on July 6, 2026, with the GitHub Security Advisory (GHSA-v82g-2437-67m2) first published on July 2, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Red Hat).

The root cause is uncontrolled resource consumption (CWE-400) and allocation of resources without limits or throttling (CWE-770). In the vulnerable code, both /v1/audio/transcriptions and /v1/audio/translations routes call await request.file.read() — an unbounded read via FastAPI/Starlette's UploadFile — which fully materializes the uploaded file into memory before the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit (default 25 MB) is checked later in _preprocess_speech_to_text(). There is no route-level check of request.file.size, Content-Length, or a bounded chunked read prior to full materialization. An authenticated API caller with access to these endpoints can submit an arbitrarily large multipart audio upload, causing vLLM to allocate memory proportional to the file size before the request is ultimately rejected (Github Advisory, vLLM Security Advisory).

The impact is exclusively an availability concern — there is no confidentiality or integrity impact. An authenticated API user with access to the speech-to-text endpoints can submit oversized audio file uploads to exhaust server memory, resulting in service degradation or process termination depending on container/process resource limits and request concurrency. This vulnerability does not enable code execution, data access, cross-tenant data exposure, or persistence after process restart (Github Advisory, Red Hat Bugzilla).

A static proof-of-concept (PoC) probe was included with the original advisory submission, which non-destructively validates the presence of the unbounded read without contacting a live server. The NVD SSVC assessment classifies exploitation as "poc" (proof-of-concept available). There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.29% (21st percentile), and the vulnerability is not listed in the CISA KEV catalog (Github Advisory, vLLM Security Advisory).

1. Identify a vulnerable deployment: Locate a vLLM instance running versions 0.22.0–0.23.0 that exposes the /v1/audio/transcriptions or /v1/audio/translations endpoints with a speech-to-text capable model configured.
2. Obtain API credentials: Acquire any API key or authentication token required to submit requests to the target endpoint.
3. Craft an oversized multipart upload: Prepare an audio file (or arbitrary binary data) significantly exceeding the 25 MB default VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit — for example, several hundred megabytes or larger.
4. Submit the request: Send a multipart HTTP POST request to /v1/audio/transcriptions or /v1/audio/translations with the oversized file as the upload payload.
5. Trigger memory exhaustion: vLLM calls await request.file.read() without bounds, materializing the entire upload into memory before validation. Depending on server memory limits and concurrent requests, this causes memory pressure, service degradation, or process termination (vLLM Security Advisory, Github Advisory).

• Network: Unusually large HTTP POST requests (well above 25 MB) to /v1/audio/transcriptions or /v1/audio/translations endpoints from a single or small number of source IPs.
• Logs: vLLM access logs showing repeated large multipart uploads to speech-to-text routes followed by rejection responses; HTTP 413 or validation error responses after significant memory allocation.
• Process/System: Sudden spikes in memory consumption by the vLLM process correlating with incoming audio upload requests; OOM (Out of Memory) killer events or container restarts triggered by the vLLM process.

Upgrade vLLM to version 0.24.0 or later, which enforces the audio upload size limit before full file materialization using a new read_upload_with_limit() helper that checks file.size metadata first and then performs a chunked read that aborts once the accumulated size exceeds the configured limit (vLLM Commit). If immediate patching is not possible, restrict access to the /v1/audio/transcriptions and /v1/audio/translations endpoints to trusted users only, or implement upstream request body size limits at the reverse proxy or ASGI layer (e.g., nginx client_max_body_size) to enforce file size restrictions before requests reach vLLM (Github Advisory).