Vllm Before 0.29.0 Heap Overflow Dos Via Iamf Audio Transcription Upload

Back www.vulncheck.com

Vllm Before 0.29.0 Heap Overflow Dos Via Iamf Audio Transcription Upload

www.vulncheck.com • October 13, 2026

Share: View original

VulnCheck Advisory: vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

vLLM Heap Overflow Vulnerability Disclosed A vulnerability (CVE-2026-109311) has been identified in vLLM versions prior to 0.29.0, allowing authenticated remote attackers to exploit a heap overflow via malformed IAMF audio transcription uploads. This flaw can crash the API process by corrupting the heap. The CVSS score for this vulnerability is 7.1, categorized as high severity. Users are advised to upgrade to vLLM version 0.29.0 or later and ensure that the API is not exposed to the internet without proper authentication. The vulnerability was published on 2026-10-12, and it affects all versions of vLLM up to 0.31.0. The potential impact includes denial of service for applications relying on vLLM for audio transcription services. 1 sources 63

Extracted Entities

Attack Types (1)

Denial of Service

CWE Weaknesses (1)

CWE-122 - Heap-based Buffer Overflow