Threats tagged 'pysec-2026-4361'

vLLM versions after 0.24.0 and before 0.31.0 have a memory exhaustion vulnerability in the MOSS-Audio model serving component. This flaw arises because the system caches a processor for every distinct mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can exploit this by sending distinct or oversized mel_config values to the /tokenize endpoint, bypassing API key protections, leading to host memory exhaustion and crashing the API process. The vulnerability is fixed in version 0.31.0.