CVE-2026-90555

[CVE catalog]

Severity

High · CVSS 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Aug 30, 2026, 10:00:00 PM UTC

Updated

Sep 12, 2026, 1:16:54 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.52% · Oct 25, 2026

A flaw was found in vLLM. An authenticated client can exploit this vulnerability by submitting forged FLAC (Free Lossless Audio Codec) headers with an inflated sample rate to the transcription endpoint. This bypasses duration checks, leading to excessive memory allocation within the API server process. The consequence is a Denial of Service (DoS), causing the API server to crash and affecting all tenants. vllm: vLLM: Denial of Service due to improper audio header validation This Moderate impact flaw in vLLM affects Red Hat AI Inference Server and Red Hat OpenShift AI (RHOAI) by allowing an authenticated attacker to trigger a denial of service. By submitting crafted FLAC audio headers with inflated sample rates to the transcription endpoint, an attacker can cause excessive memory allocation, leading to the API server process crashing and impacting all tenants. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.