CVE-2026-90555 - vLLM before 0.28.0 Denial of Service via Audio Header
Brief
CVE ID : CVE-2026-90555
Published : Sept. 12, 2026, 1:16 p. m.
- 7 hours, 36 minutes ago
Description : vLLM versions before 0.
- 0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.
Severity: 7.1
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...