{"id":"CVE-2026-90555","title":"vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks","summary":"vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigge…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-409","CWE-770"],"vendor":"vllm","product":"vllm","affected":["vllm < 0.28.0"],"patched":["vllm 0.28.0"],"published":"2026-09-12","updated":"2026-09-16","sourceUpdated":"2026-09-16T17:31:06.907","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90555","references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-99f2-hwrc-gvq8","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/vllm-before-0.28.0-denial-of-service-via-audio-header","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90555.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-90555"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532566"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90555"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90555"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.0052,"epssPercentile":0.43978,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T16:00:25.914795Z"},"ingestedAt":"2026-09-14T15:23:07.479Z","slug":"CVE-2026-90555","body":"## Overview\n\nvLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.\n\n## Affected\n\n- `vllm < 0.28.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `vllm 0.28.0`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90555.json)","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}