CVE-2026-55646: vLLM speech-to-text enforces size limit after full file read

# CVE-2026-55646: vLLM speech-to-text enforces size limit after full file read

https://gcdradar.vercel.app/incidents/cve-2026-55646-vllm-speech-to-text-enforces-size-limit-after · AIR-2026-0809 · closed 2026-07-06

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-07-06 (happened 2026-07-17)
- AI role: Attack on AI
- Products: vLLM
- CVE ids: CVE-2026-55646
- CVSS: 6.5

## Summary

The audio transcription and translation endpoints in vLLM read uploaded files into memory entirely before enforcing the maximum file size limit. This design can lead to memory exhaustion and denial of service through oversized uploads.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-07-17: CVE-2026-55646: vLLM: Speech-to-text upload size limit is enforced after full UploadFile read (https://github.com/advisories/GHSA-v82g-2437-67m2)
- 2026-07-06: CVE-2026-55646: vLLM is an inference and serving engine for large language models. (https://nvd.nist.gov/vuln/detail/CVE-2026-55646)

## Sources

- 2026-07-06 NVD: CVE-2026-55646: vLLM is an inference and serving engine for large language models. https://nvd.nist.gov/vuln/detail/CVE-2026-55646
- 2026-07-17 GitHub Advisory Database: CVE-2026-55646: vLLM: Speech-to-text upload size limit is enforced after full UploadFile read https://github.com/advisories/GHSA-v82g-2437-67m2

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.