CVE-2026-90555— vLLM before 0.28.0 Denial of Service via Audio Header
Quick assessment
Affected
vllm-project vLLM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
vLLM 0.28.0 之前的版本在语音转录端点（transcription endpoint）中未校验音频采样率（sample rate）头部信息，使得已认证的客户端能够绕过时长（duration）检查。攻击者可以提交伪造的 FLAC 头部信息，其中采样率被故意夸大，从而触发过度的内存分配，导致 API 服务器进程崩溃，影响所有租户。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90555
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
vLLM before 0.28.0 Denial of Service via Audio Header
Source: CVE Program / CVE List V5
Vulnerability Description
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| vllm-project | vLLM | 0 ~ 0.28.0 | - |
|
II. Public POCs for CVE-2026-90555
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90555
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-90555 (2)
-
-
🔗 vLLM before 0.28.0 Denial of Service via Audio Header | Advisories | VulnCheck third-party-advisory
Same Patch Batch · vllm-project · 2026-09-12 · 3 CVEs total
| CVE-2026-90553 | 7.8 HIGH | vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor |
| CVE-2026-90554 | 6.2 MEDIUM | vLLM before 0.28.0 Denial of Service via audio extraction |
IV. Related Vulnerabilities
Same product: vLLM
-
CVE-2026-90554
vLLM before 0.28.0 Denial of Service via audio extraction -
CVE-2026-90553
vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 -
CVE-2026-78684
vLLM before 0.27.0 Denial of Service via DeepStream Backend -
CVE-2026-73560
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiMod -
CVE-2026-71486
vLLM: Derender endpoints decode caller-supplied GenerateResp
Same vendor: vllm-project
-
CVE-2026-90554
vLLM before 0.28.0 Denial of Service via audio extraction -
CVE-2026-90553
vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 -
CVE-2026-78684
vLLM before 0.27.0 Denial of Service via DeepStream Backend -
CVE-2026-73560
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiMod -
CVE-2026-71486
vLLM: Derender endpoints decode caller-supplied GenerateResp
Same weakness: CWE-409
-
CVE-2026-46387
Suricata http2: decompression bomb can cause denial of servi -
CVE-2026-79695
Dell Secure Connect Gateway 资源管理错误漏洞 -
CVE-2026-69304
ASP.NET Core Denial of Service Vulnerability -
CVE-2026-85786
Incomplete fix for CVE-2026-75936 memory-amplification denia -
CVE-2026-82520
parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attach
V. Comments for CVE-2026-90555
No comments yet