CVE-2026-90555

MEDIUM 6.5

vLLM before 0.28.0 Denial of Service via Audio Header

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.

CWE	CWE-409
Vendor	vllm-project
Product	vllm
Published	Sep 12, 2026
Last Updated	Sep 14, 2026

Stay Ahead of the Next One

Get instant alerts for vllm-project vllm

Be the first to know when new medium vulnerabilities affecting vllm-project vllm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

vllm-project / vLLM

0 < 0.28.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/vllm-project/vllm/security/advisories/GHSA-99f2-hwrc-gvq8 vulncheck.com: https://www.vulncheck.com/advisories/vllm-before-0.28.0-denial-of-service-via-audio-header

Credits

🔍 oran-s jperezdealgaba