CVE-2026-90555
7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Summary
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| vllm-project | vLLM | 0 < 0.28.0 | affected |
| vllm-project | vLLM | 0.28.0 | unaffected |
Weaknesses
- CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
References
- https://github.com/vllm-project/vllm/security/advisories/GHSA-99f2-hwrc-gvq8
- https://www.vulncheck.com/advisories/vllm-before-0.28.0-denial-of-service-via-audio-header
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.