vLLM: Memory exhaustion via unbounded MOSS-Audio processor cache in /tokenize
Summary
vLLM versions from 0.25.0 up to 0.31.0 (not including 0.31.0) cache a processor for every distinct request-controlled mm_processor_kwargs value when serving MOSS-Audio models. The /tokenize endpoint is outside the API-key-protected route prefixes, so --api-key does not restrict it. An unauthenticated attacker who can reach the API can send many distinct or oversized mel_config values, exhausting host memory and crashing the API process. The impact is availability only.
Affected
- vLLM 0.25.0 up to but not including 0.31.0 (the CVE text says after 0.24.0; the exact start of the range is not fully stated)
- Only deployments that serve MOSS-Audio models are affected
Fixed in
- Upgrade to vLLM 0.31.0 or later
Workaround
- No vendor workaround found.
- Restrict access to /tokenize at a reverse proxy or firewall, because the API key does not protect it.
- Set container or process memory limits.
- Stop serving MOSS-Audio models if they are not needed.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Not listed as known exploited (not in CISA KEV).
- No public proof-of-concept found.
Our recommendation
- Check whether any vLLM instance serves MOSS-Audio models and whether its /tokenize endpoint is reachable from untrusted networks.
- Upgrade affected instances to vLLM 0.31.0 or later. Assess other CVEs fixed in the same release separately.
- Until the upgrade, restrict /tokenize access and set memory limits.
- Monitor the API for memory growth and unexpected restarts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-823j-m4cj-hmjf github.com
- VulnCheck advisory: vLLM MOSS-Audio memory exhaustion www.vulncheck.com
- OSV: CVE-2026-114052 osv.dev
- Strix: CVE-2026-114052 www.strix.ai
- OpenCVE: CVE-2026-114052 app.opencve.io
- HOL Guard: CVE-2026-114052 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:12.
Original description (NVD)
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.