CVE-2026-90555: fallo de gravedad alta en vllm-project vLLM
vLLM before 0.28.0 Denial of Service via Audio Header
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.5%
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
vllm-project · vLLMCVEs relacionadas — vllm-project vLLM
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-103241MEDIUMvllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of serviceEPSS 0.7%CVE-2026-92220MEDIUMvllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumptionEPSS 0.7%CVE-2026-90878MEDIUMvllm-project vLLM Jinja Template Rendering completions resource consumptionEPSS 0.5%CVE-2026-105922MEDIUMvllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of serviceEPSS 0.3%CVE-2026-90553HIGHvLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processorEPSS 0.3%CVE-2026-105775MEDIUMvllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-boundsEPSS 0.3%