{"id":"CVE-2026-90555","state":"PUBLISHED","title":"vLLM before 0.28.0 Denial of Service via Audio Header","description":"vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.","publishedAt":"2026-09-12T12:08:58.226Z","updatedAt":"2026-09-14T16:00:38.578Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["vllm-project vLLM"],"affected":[{"vendor":"vllm-project","product":"vLLM","packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.28.0","versionType":"semver"},{"version":"0.28.0","status":"unaffected","versionType":"semver"}]}],"references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-99f2-hwrc-gvq8","https://www.vulncheck.com/advisories/vllm-before-0.28.0-denial-of-service-via-audio-header"],"weaknesses":["CWE-409"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/90xxx/CVE-2026-90555.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90555","state":"PUBLISHED","datePublished":"2026-09-12T12:08:58.226Z","dateUpdated":"2026-09-14T16:00:38.578Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-09-12T11:13:43.326Z"},"containers":{"cna":{"title":"vLLM before 0.28.0 Denial of Service via Audio Header","descriptions":[{"lang":"en","value":"vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants."}],"affected":[{"vendor":"vllm-project","product":"vLLM","packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.28.0","versionType":"semver"},{"version":"0.28.0","status":"unaffected","versionType":"semver"}]}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-99f2-hwrc-gvq8","tags":["vendor-advisory"],"name":"GitHub Security Advisory (GHSA-99f2-hwrc-gvq8)"},{"url":"https://www.vulncheck.com/advisories/vllm-before-0.28.0-denial-of-service-via-audio-header","name":"VulnCheck Advisory: vLLM before 0.28.0 Denial of Service via Audio Header","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-409","lang":"en","description":"Improper Handling of Highly Compressed Data (Data Amplification)","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-09-12T12:08:58.226Z"},"datePublic":"2026-08-28T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndExcluding":"0.28.0"}]}]}],"credits":[{"lang":"en","value":"oran-s","type":"reporter"},{"lang":"en","value":"jperezdealgaba","type":"coordinator"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-14T16:00:25.914795Z","id":"CVE-2026-90555","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-14T16:00:38.578Z"}}]}}}