CVE-2026-90555 in vLLM
要約
〜によって MITRE • 2026年09月12日
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.
If you want to get best quality of vulnerability data, you may have to visit VulDB.