Is CVE-2026-54233 exploitable?

No community verdicts yet for CVE-2026-54233. Be the first to weigh in.

Is CVE-2026-54233 a false positive?

No community verdicts yet for CVE-2026-54233.

How do I remediate CVE-2026-54233?

See the authoritative references (NVD, vendor advisory) and community field notes on this page for remediation guidance.

CVE-2026-54233

is CVE-2026-54233real, exploitable, or a false positive? Here's the community verdict.

☆ Watch

Medium · CVSS 6.5EPSS 0.3%CWE-409

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, vLLM's /v1/audio/transcriptions endpoint limits compressed upload size but not decoded PCM output. A 25MB OPUS file expands to ~14.9GB of float32 PCM at decode time. This vulnerability is fixed in 0.23.1rc0.

References

NVD MITRE CVE.org

Published Jun 22, 2026

Embed this verdict

Markdown

[![TruePositive verdict](https://www.truepositive.app/cve/CVE-2026-54233/badge.svg)](https://www.truepositive.app/cve/CVE-2026-54233)

HTML

<a href="https://www.truepositive.app/cve/CVE-2026-54233"><img src="https://www.truepositive.app/cve/CVE-2026-54233/badge.svg" alt="TruePositive verdict for CVE-2026-54233"></a>

Live badge that updates automatically as the community verdict changes.

Community ground truth

In your experience, is this finding real and exploitable?

0 verdicts

Not a real issue

No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.

Field notes & remediation

Verdicts are the quick signal. Notes are the evidence and fixes behind them.

No notes yet. Be the first to share what you saw, or a fix that worked.

Add a field note or remediationoptional

Same weakness: CWE-409.

CVE-2026-48510CVSS 7.5EPSS 0%
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small payload can claim a very large uncompressed length and force a large allocation before LZ4 decoding begins. This vulnerability is fixed in 2.5.301 and 3.1.7.

CVE-2026-54233

Community ground truth

Field notes & remediation

Related CVEs