AI Threat Alert
CVE-2026-90555: vLLM: FLAC header spoofing crashes transcription API
MEDIUMA flaw in vLLM's transcription endpoint fails to validate audio sample rate headers, letting any authenticated user submit a forged FLAC file with an inflated sample rate that slips past duration checks and forces the server to allocate excessive memory, crashing the API process for every tenant sharing that instance. This is a low-complexity, low-privilege attack (CVSS 6.5, AV:N/AC:L/PR:L) with no public exploit or scanner template known and no EPSS or CISA KEV signal, so it is not being mass-exploited today — but any org running a shared or multi-tenant vLLM deployment with the transcription endpoint enabled is exposed to a trivial single-request denial of service from any valid API key holder, including a compromised or malicious low-privilege account. The blast radius is availability-only (C:N/I:N/A:H): no data is exposed or altered, but a crashed inference server can take down every downstream application depending on that vLLM instance. Patch to vLLM 0.28.0 or later; until then, front the transcription endpoint with strict server-side audio validation (reject headers whose sample rate implies unreasonable memory allocation) and monitor for repeated OOM kills or crash-restart loops on vllm serve processes correlated with transcription API calls.
What is the risk?
Medium severity, availability-only impact. Exploitability is high in principle — network-reachable, low attack complexity, no user interaction — but requires a valid low-privilege API credential, which limits exposure to insiders, compromised accounts, or multi-tenant customers rather than fully anonymous internet attackers. No evidence of active exploitation (not in CISA KEV, no EPSS score published, no known public PoC or Nuclei template), so this is currently a latent rather than actively weaponized risk. The main danger is amplification: a single crafted request can crash a shared inference process, producing outsized impact relative to attacker effort in any environment where vLLM's transcription endpoint serves multiple tenants or applications.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| vLLM | pip | — | No patch |
Do you use vLLM? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
Upgrade to vLLM 0.28.0 or later, which validates audio sample rate headers before allocating buffers. If immediate patching isn't possible: enforce a hard server-side cap on decoded audio buffer size independent of client-supplied headers, validate FLAC/audio headers against actual file size before allocation, rate-limit and isolate the transcription endpoint per API key, and run transcription workloads in resource-limited containers (cgroup memory caps) so a single malformed request can't OOM-kill the shared process. For detection, alert on vllm serve process restarts or OOM events correlated with transcription API calls, and log/flag requests where the claimed sample rate in the header is inconsistent with the payload size.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-90555?
A flaw in vLLM's transcription endpoint fails to validate audio sample rate headers, letting any authenticated user submit a forged FLAC file with an inflated sample rate that slips past duration checks and forces the server to allocate excessive memory, crashing the API process for every tenant sharing that instance. This is a low-complexity, low-privilege attack (CVSS 6.5, AV:N/AC:L/PR:L) with no public exploit or scanner template known and no EPSS or CISA KEV signal, so it is not being mass-exploited today — but any org running a shared or multi-tenant vLLM deployment with the transcription endpoint enabled is exposed to a trivial single-request denial of service from any valid API key holder, including a compromised or malicious low-privilege account. The blast radius is availability-only (C:N/I:N/A:H): no data is exposed or altered, but a crashed inference server can take down every downstream application depending on that vLLM instance. Patch to vLLM 0.28.0 or later; until then, front the transcription endpoint with strict server-side audio validation (reject headers whose sample rate implies unreasonable memory allocation) and monitor for repeated OOM kills or crash-restart loops on vllm serve processes correlated with transcription API calls.
Is CVE-2026-90555 actively exploited?
No confirmed active exploitation of CVE-2026-90555 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-90555?
Upgrade to vLLM 0.28.0 or later, which validates audio sample rate headers before allocating buffers. If immediate patching isn't possible: enforce a hard server-side cap on decoded audio buffer size independent of client-supplied headers, validate FLAC/audio headers against actual file size before allocation, rate-limit and isolate the transcription endpoint per API key, and run transcription workloads in resource-limited containers (cgroup memory caps) so a single malformed request can't OOM-kill the shared process. For detection, alert on vllm serve process restarts or OOM events correlated with transcription API calls, and log/flag requests where the claimed sample rate in the header is inconsistent with the payload size.
What systems are affected by CVE-2026-90555?
This vulnerability affects the following AI/ML architecture patterns: model serving, multimodal inference pipelines, agent frameworks (voice-enabled).
What is the CVSS score for CVE-2026-90555?
CVE-2026-90555 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.29%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0029 Denial of AI Service AML.T0034.001 Resource-Intensive Queries AML.T0040 AI Model Inference API Access Compliance Controls Affected
What are the technical details?
Original Advisory
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.
Exploitation Scenario
An attacker with a valid but low-privilege API key to a shared vLLM deployment crafts a FLAC file with a legitimate-looking header but an artificially inflated sample rate field, then submits it to the /transcriptions endpoint. Because vLLM trusts the header value to compute expected audio duration and buffer size rather than validating it against the actual payload, the server allocates memory proportional to the forged (inflated) sample rate instead of the real, small file. This triggers excessive memory consumption and crashes the inference server process, taking down transcription — and potentially all inference — for every other tenant or application sharing that vLLM instance, with a single unauthenticated-looking request from an otherwise legitimate account.
Weaknesses (CWE)
CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
Primary
CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification): The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H References
Timeline
Related Vulnerabilities
CVE-2024-9053 9.8 vllm: RCE via unsafe pickle deserialization in RPC server
Same package: vllm CVE-2024-11041 9.8 vllm: RCE via unsafe pickle deserialization in MessageQueue
Same package: vllm CVE-2025-47277 9.8 vLLM: RCE via exposed TCPStore in distributed inference
Same package: vllm CVE-2026-25960 9.8 vllm: SSRF allows internal network access
Same package: vllm CVE-2025-32444 9.8 vLLM: RCE via pickle deserialization on ZeroMQ
Same package: vllm