CVE-2026-90555
vLLM before 0.28.0 Denial of Service via Audio Header
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 12, 2026
- Updated
- Sep 14, 2026
- Reserved
- Sep 12, 2026
Description
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
Affected Products
| Product | Versions |
|---|---|
vLLMvllm-project |
|
References
- GitHub Security Advisory (GHSA-99f2-hwrc-gvq8)vendor-advisory
- VulnCheck Advisory: vLLM before 0.28.0 Denial of Service via Audio Headerthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.