CVE-2026-90555CWE-409

CVE-2026-90555

Medium · published September 12, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00520 · 43.3th percentile
Weakness
CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
Published
2026-09-12T17:16Z
Affected products (1)
ProductVersionsFixed in
vllm/vllm< 0.28.00.28.0
References (2)
https://github.com/vllm-project/vllm/security/advisories/GHSA-99f2-hwrc-gvq8 · [email protected]https://www.vulncheck.com/advisories/vllm-before-0.28.0-denial-of-service-via-audio-header · [email protected]
EPSS history
Timeline
  • 14 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 12 SEP 12:08Z
    vLLM before 0.28.0 Denial of Service via Audio Header
    cvelistv5