CVE-2026-90555: vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authentic

vLLM (an open-source LLM serving framework) versions before 0.28.0 don't properly check audio sample rate headers (the metadata describing how many audio samples are recorded per second) in its transcription endpoint, letting authenticated users submit fake audio headers with inflated sample rates that cause the server to allocate excessive memory and crash. This affects all users of the affected vLLM instance.