vLLM audio processor cache memory exhaustion vulnerability
Start here
vLLM disclosed a MOSS-Audio audio processor cache memory exhaustion vulnerability: when serving the MOSS-Audio model, request-level processor configurations enter an unbounded cache, and repeated different configurations or oversized allocations can exhaust the API process's memory or severely degrade it. Any client with access to /tokenize can trigger it; this endpoint is not protected by --api-key's route authentication, so the API key itself cannot replace external access control. The GitHub advisory marks affected versions as > 0.24.0, < 0.31.0 and the fixed version as 0.31.0.
Generated by AI from reports · Updated 2 days ago
Progress timeline
- GitHub 安全公告SelectedvLLM disclosed a MOSS-Audio audio processor cache memory exhaustion vulnerability
When vLLM serves the MOSS-Audio model, request-level processor configurations enter an unbounded cache, and repeated different configurations or oversized allocations can exhaust the API process's memory or severely degrade it. Any client with access to /tokenize can trigger it; this endpoint is not protected by --api-key's route authentication, so the API key itself cannot replace external access control. The GitHub advisory marks affected versions as > 0.24.0, < 0.31.0 and the fixed version as 0.31.0.
Related discussion
Attention trend
New sources per day
- Oct 8New1 sources (1 outlets,0 accounts)
- Oct 9New0 sources (0 outlets,0 accounts)
- Oct 10New0 sources (0 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New0 sources (0 outlets,0 accounts)
- Oct 13New0 sources (0 outlets,0 accounts)