CVE-2026-90555

EUVD-2026-76873
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.
Data Amplification
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
vllmvllm
𝑥
< 0.28.0
CNA
Common Weakness Enumeration
References
https://github.com/vllm-project/vllm/security/advisories/GHSA-99f2-hwrc-gvq8
https://www.vulncheck.com/advisories/vllm-before-0.28.0-denial-of-service-via-audio-header