CVE-2026-90555 in vLLM
Summary
by MITRE • 09/12/2026
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in vLLM versions prior to 0.28.0 represents a critical failure in input validation within the audio transcription endpoint, specifically concerning the handling of FLAC file headers. As an open-source large language model inference and serving engine, vLLM is designed to handle diverse multimodal inputs, including audio data for speech-to-text applications. The core technical flaw lies in the absence of rigorous verification of the sample rate metadata embedded within the FLAC container format before processing begins. When a client submits an audio file, the system parses the header information to determine how much memory should be allocated for decoding and subsequent inference operations. In this specific instance, the software fails to validate whether the declared sample rate is consistent with standard constraints or physically plausible limits for the target hardware architecture. This oversight allows authenticated users to craft malicious payloads by manipulating the FLAC headers to report an artificially inflated sample rate that does not reflect the actual audio data size but rather dictates a massive memory allocation request from the underlying system resources.
From a technical perspective, this flaw exploits the trust placed in metadata fields without cross-referencing them against expected bounds or performing sanity checks on the resulting resource consumption estimates. The vulnerability is classified under CWE-20 Improper Input Validation and CWE-400 Uncontrolled Resource Consumption. By submitting forged headers with excessively high sample rates, an attacker can trick the vLLM server into allocating memory proportional to these inflated values rather than the actual file size or reasonable processing limits. This behavior leads directly to a denial of service condition through resource exhaustion. The excessive allocation quickly depletes available system memory, causing the API server process to crash due to out-of-memory errors. Because vLLM often operates in multi-tenant environments where multiple users share the same inference backend, this crash affects all active tenants and services relying on that instance, resulting in a widespread service outage rather than an isolated failure for the attacking user alone.
The operational impact of this vulnerability is severe due to its potential for remote exploitation by authenticated actors. While authentication provides some level of access control, it does not mitigate risks associated with resource abuse within permitted operations. An attacker who has valid credentials can repeatedly trigger these crashes, effectively creating a persistent denial-of-service attack vector against the inference infrastructure. This disrupts availability for legitimate users and increases operational costs due to the need for frequent service restarts or scaling events. Furthermore, in cloud-native deployments where auto-scaling policies might attempt to compensate for crashed instances by spinning up new ones, this vulnerability could lead to rapid cost escalation if not properly monitored and throttled at a higher infrastructure level. The attack aligns with MITRE ATT&CK technique T1499 Endpoint Denial of Service, specifically illustrating how application-layer flaws can be leveraged to degrade system availability without requiring privilege escalation beyond initial authentication.
Mitigation strategies must focus on both immediate patching and architectural hardening. The primary remediation is to upgrade vLLM to version 0.28.0 or later, where the developers have implemented proper validation logic for audio sample rate headers. This ensures that only valid, bounded sample rates are accepted during the transcription process. In addition to upgrading, organizations should implement strict input size limits and memory quotas at the API gateway level to prevent any single request from consuming disproportionate resources regardless of application-level flaws. Implementing rate limiting on the transcription endpoint can also mitigate the impact by restricting the frequency of audio submissions per user or IP address. Security teams should monitor system metrics for sudden spikes in memory usage associated with media processing endpoints and configure alerts to detect potential abuse patterns indicative of this specific vulnerability vector.