7.1
High
CVE-2026-90555 vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing…
Description
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| vllm 0.28 | earliest → < 0.28.0 | 0.28.0 |
References
- GitHub Security Advisory (GHSA-99f2-hwrc-gvq8) github.com
- VulnCheck Advisory: vLLM before 0.28.0 Denial of Service via Audio Header www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of vllm
The 121 CVEs of vllm →
CVE-2026-115918
vLLM is an inference and serving engine for large language models
6.5
Medium
CVE-2026-115917
vLLM is an inference and serving engine for large language models
3.4
Low
CVE-2026-115916
vLLM is an inference and serving engine for large language models
6.5
Medium
CVE-2026-115915
vLLM is an inference and serving engine for large language models
8.1
High