CVE-2026-114052: vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs

Q: Which deployments are exposed?

Deployments serving the MOSS-Audio model with vLLM versions after 0.24.0 and before 0.31.0 are affected. The exposed endpoint is /tokenize.

Q: Does an attacker need credentials or an API key?

No. The /tokenize endpoint bypasses --api-key, so an unauthenticated network attacker can send requests to trigger the issue.

Q: What request behavior triggers the denial of service?

An attacker can submit distinct or oversized mel_config values through mm_processor_kwargs. Each distinct value causes a processor to be cached in an unbounded dictionary, consuming host memory until the API process crashes.

Q: What should be prioritized for mitigation?

Upgrade to vLLM 0.31.0 or later. Until upgrading, restrict untrusted access to /tokenize and prevent unauthenticated clients from reaching the API service.

Published Oct 21, 2026

Updated

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mmprocessorkwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized melconfig values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.

Affected Software

1 affected component

vllm vllm>0.24.0<0.31.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade vLLM to a version that resolves this vulnerability.
Fixed in 0.31.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments serving the MOSS-Audio model with vLLM versions after 0.24.0 and before 0.31.0 are affected. The exposed endpoint is /tokenize.

Does an attacker need credentials or an API key?

No. The /tokenize endpoint bypasses --api-key, so an unauthenticated network attacker can send requests to trigger the issue.

What request behavior triggers the denial of service?

An attacker can submit distinct or oversized mel_config values through mm_processor_kwargs. Each distinct value causes a processor to be cached in an unbounded dictionary, consuming host memory until the API process crashes.

What should be prioritized for mitigation?

Upgrade to vLLM 0.31.0 or later. Until upgrading, restrict untrusted access to /tokenize and prevent unauthenticated clients from reaching the API service.

CVE-2026-114052: vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

Does an attacker need credentials or an API key?

What request behavior triggers the denial of service?

What should be prioritized for mitigation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does an attacker need credentials or an API key?

What request behavior triggers the denial of service?

What should be prioritized for mitigation?