MEDIUM

CVE-2026-90555

Vllm Vllm 2026-09-12 CVSS v3.1

CVSS

6.5

Description

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.

Weakness (CWE)

CWE-409

EPSS Score

0.29%

Probability of exploitation in next 30 days

22.2th percentile

References

https://github.com/vllm-project/vllm/security/advisories/GHSA-99f2-hwrc-gvq8 Vendor Advisory https://www.vulncheck.com/advisories/vllm-before-0.28.0-denial-of-service-via-audio-header Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE