CVE-2026-90554

[CVE catalog]

Severity

Medium · CVSS 6.9CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Sep 12, 2026, 12:08:57 PM UTC

Updated

Sep 12, 2026, 1:16:54 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.20% · Oct 25, 2026

A flaw was found in vLLM. This vulnerability allows a remote attacker to cause a denial of service by providing a specially crafted, highly compressed video as multimodal input when the NanoNemotronVL model is configured to use audio from video. The lack of proper size or duration limits during audio extraction from the video input can force the server to allocate excessive memory, leading to system instability and preventing legitimate users from accessing the service. vllm: vLLM: Denial of Service via video audio extraction This vulnerability has a Moderate impact on Red Hat products. When vLLM is configured to extract audio from video input for NanoNemotronVL models with `use_audio_in_video=True`, a remote attacker can provide a small, highly compressed video to trigger excessive memory allocation. This can lead to a denial of service for the vLLM server, impacting the availability of AI inference services. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.