CVE-2026-90554: vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video

vLLM versions 0.10.2 through 0.27.x have a vulnerability where audio extraction from video files lacks size and duration limits, allowing attackers to upload specially crafted compressed videos that force the server to use massive amounts of memory during decoding (a denial of service attack, where legitimate users can't access the service). This only affects NanoNemotronVL models when video audio processing is enabled.