The vulnerability arises from the input_audio handling path in vllm before version 0.24.0, where AudioMediaIO.load_bytes or AudioMediaIO.load_file functions are called without passing the VLLM_MAX_AUDIO_DECODE_DURATION_S parameter to the shared audio decoder. This omission allows an unauthenticated client to submit a compressed audio input that expands into a very large float32 PCM allocation, bypassing the duration guard used in other endpoints. Inline data URLs also bypass the audio fetch timeout, leading to potential out-of-memory crashes of the worker process. The vulnerability affects deployments serving audio-capable models and is fixed in vllm 0.24.0.

An unauthenticated attacker can cause a denial-of-service condition by submitting specially crafted compressed audio inputs that consume excessive memory during decompression, leading to out-of-memory crashes of the worker process. There is no impact on confidentiality or integrity, only availability is affected.

Upgrade to vllm version 0.24.0 or later, where this issue is fixed by enforcing the maximum audio decode duration limit in the affected code path. No other mitigations are indicated.