{"data":{"id":"8cf2673c-887e-4dd0-b9a2-27092fff7924","title":"CVE-2026-90554: vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from…","summary":"vLLM versions 0.10.2 up to but not including 0.28.0 apply no audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. The _extract_audio_from_videos function in nano_nemotron_vl.py calls load_audio_pyav without the max_duration_s or max_decode_bytes parameters, so VLLM_MAX_AUDIO_DECODE_DURATION_S and VLLM_MAX_AUDIO_DECODE_BYTES are not enforced. When such a model is served with use_audio_in_video=True, an attacker supplying a small, highly compressed video can make the server allocate gigabytes of memory during audio decoding, causing a denial of service.","solution":"Fixed in vLLM 0.28.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90554","publishedAt":"2026-09-12T13:16:54.040Z","cveId":"CVE-2026-90554","cweIds":["CWE-400"],"cvssScore":"6.2","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["vLLM","NanoNemotronVL"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM denial of service through unbounded audio decoding from video input","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"local","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00201,"epssCheckedAt":"2026-11-04T12:08:34.077Z","kevDateAdded":null,"advisoryAliases":["GHSA-m39m-2pqx-3vm2"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-01T06:08:36.234Z","patchAvailable":null,"disclosureDate":"2026-09-12T13:16:54.040Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-125","CAPEC-130"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}