vLLM Audio Sample Rate Header Validation Bypass

Executive Summary

CVE-2026-90555 is a vulnerability in vLLM versions before 0.28.0 where authenticated clients can bypass audio duration checks by forging FLAC headers with inflated sample rates. This causes excessive memory allocation during audio decoding, crashing the API server and affecting all tenants.

Useful 0 Not Useful 0

Detection Guidance

Monitor API server logs for repeated crashes or out-of-memory (OOM) kills, particularly after processing audio transcription requests. Check for requests to the /v1/audio/transcriptions endpoint with unusually high sample rates (e.g., 655350 Hz) in FLAC headers. Use network traffic analysis tools to inspect audio file headers for forged sample rates.

Useful 0 Not Useful 0

Impact Analysis

An attacker can send a small FLAC file with a manipulated sample rate to the transcription endpoint, triggering an out-of-memory condition. This crashes the shared API server, causing a denial of service for all users and potentially disrupting services relying on the API.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to service disruptions, violating availability requirements in GDPR and HIPAA. Downtime may result in non-compliance with data processing timelines or access controls, potentially exposing sensitive data during outages.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade vLLM to version 0.28.0 or later to address the vulnerability. Disable the transcription endpoint if not in use. Implement rate limiting and request size restrictions for audio endpoints. Monitor memory usage and API server stability closely.

Useful 0 Not Useful 0