What’s Vulnerable › Vulnerabilities

CVE-2026-90555: vLLM before 0.28.0 Denial of Service via Audio Header

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-12 · updated 2026-09-16
• Weakness: CWE-409

Description

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.

Affected products

• vllm-project vllm: before 0.28.0 — fixed in 0.28.0

How to fix

Upgrade to a fixed version: vllm-project vllm 0.28.0. Check the vendor advisory for mitigations.

References

• https://github.com/vllm-project/vllm/security/advisories/GHSA-99f2-hwrc-gvq8
• https://www.vulncheck.com/advisories/vllm-before-0.28.0-denial-of-service-via-audio-header

Get alerted when CVE-2026-90555 or the next vulnerability affects your stack