vLLM vulnerability: Phi-4 multimodal audio encoder materializes and retains the full attention matrix; a single maximum-length audio request can crash the entire engine with OOM

vLLM fixed a denial-of-service vulnerability (GHSA-8397-8qf6-f2gm / CVE-2026-115913): in versions before 0.32.0, under the default deployment, any unauthenticated client sending a single valid 10-minute audio request could crash the entire engine serving Phi-4-multimodal-instruct with OOM, requiring a process restart to recover. The root cause is that the Phi-4 multimodal audio encoder uses the eager attention path by default, fully materializing an approximately 120×16×500×500 attention matrix per layer and retaining all 24 layers, with GPU memory continuously climbing within a single request until allocation fails. The authors verified on the official vllm/vllm-openai:v0.31.0 image that a 19.2 MB 600-second silent WAV triggered CUDA OOM in about 6 seconds; the crash is deterministic and independent of load. After the request ends, the matrices still reside in GPU memory, with usage equal to the largest audio processed since startup; under large-memory deployments, several consecutive maximum-length requests can achieve the same effect.