Skip to content
vLLM Heap Overflow Vulnerability Disclosed

vLLM Heap Overflow Vulnerability Disclosed

First seen 13 Oct 2026, 18:32 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 13, 2026 at 19:59 UTC
  • •CVE-2026-109311 affects vLLM versions before 0.29.0.
  • •The vulnerability allows for a heap overflow via IAMF audio uploads.
  • •Users must upgrade to vLLM 0.29.0 or later to mitigate the risk.

A vulnerability (CVE-2026-109311) has been identified in vLLM versions prior to 0.29.0, allowing authenticated remote attackers to exploit a heap overflow via malformed IAMF audio transcription uploads. This flaw can crash the API process by corrupting the heap. The CVSS score for this vulnerability is 7.1, categorized as high severity. Users are advised to upgrade to vLLM version 0.29.0 or later and ensure that the API is not exposed to the internet without proper authentication. The vulnerability was published on 2026-10-12, and it affects all versions of vLLM up to 0.31.0. The potential impact includes denial of service for applications relying on vLLM for audio transcription services.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-12
CVE-2026-109311 published
The vulnerability affecting vLLM versions before 0.29.0 was officially disclosed, with a CVSS score of 7.1.
Pocketclaw.Dev

More articles in this cluster (4)

Following this threat?

Track CVE-2026-109311 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 3

Common questions

What versions are affected?
All versions of vLLM prior to 0.29.0 are affected by this vulnerability.
What is the CVSS score?
The CVSS score for CVE-2026-109311 is 7.1, indicating a high severity level.
What should I do to protect my systems?
Upgrade to vLLM version 0.29.0 or later and ensure proper authentication for the API.