CVE-2026-90555: vLLM audio sample rate validation flaw in transcription endpoint

Summary

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, letting authenticated clients bypass duration checks. An attacker can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process, affecting all tenants.

Mitigation

Fixed in 0.28.0.

Topics

• Inference infrastructure

Related items

• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence
• InfoThe Blind Spots of Detection: Adversarial Perturbation Attacks against Watchdogs in Distributed LLM InferenceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• HighCVE-2026-118761: Kubeflow Pipelines decompression bomb in pipeline archive uploadSimilar attack · NVD/CVE Database
• LowOpenCode User Hit with Hostile Backlash After Reporting Free AI LoopholeSimilar attack · Socket Blog