EUVD-2026-76873
GHSA-mpw6-hvj8-87hq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid API credentials
-
DeliveryCraft FLAC file with inflated sample rate header
-
ExploitSubmit forged FLAC to transcription endpoint
-
ExecutionServer allocates excessive memory buffer
-
PersistAPI server process crashes
-
ImpactAll tenants lose service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
|
| Exploitation Conditions | Exploitation requires valid API credentials sufficient for authenticated access to the vLLM transcription endpoint (CVSS PR:L). The transcription endpoint must be enabled and reachable over the network. The attacker must be able to submit audio requests (FLAC format) to this endpoint. No elevated privileges or administrative access are needed - any authenticated user qualifies. Limiting factors include: the authentication barrier (unauthenticated attackers cannot exploit this directly), and the requirement that the transcription feature is in use (deployments using vLLM solely for text completion without audio transcription are not exposed to this specific endpoint). |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: network-reachable, low complexity, requires authentication (PR:L), and produces high availability impact with no confidentiality or integrity loss. The multi-tenant crash amplifies real-world severity - one authenticated user can impact all tenants simultaneously, making the effective blast radius larger than a single-user DoS. EPSS data was not provided in the input, and the vulnerability is not in CISA KEV, indicating no confirmed active exploitation. The authentication requirement (PR:L) limits opportunistic, unauthenticated abuse but any valid API credential is sufficient. Given the growing deployment of vLLM in production AI inference stacks, the risk is meaningful for organizations exposing the transcription endpoint to external or multi-tenant users. |
| Exploit ScenarioDerived | An authenticated API client submits a POST request to vLLM's transcription endpoint containing a minimal FLAC file with a forged header specifying an extremely large sample rate value. The server trusts the header and attempts to allocate a proportionally large memory buffer, exhausting process memory. The API server process crashes, interrupting inference requests from all other tenants sharing the same vLLM instance until it is restarted. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 12, 2026
Uncontrolled memory allocation in vLLM's transcription endpoint before 0.28.0 allows authenticated API clients to crash the entire server process by submitting FLAC audio files with forged, inflated sample rate headers. Because vLLM commonly operates as a shared API server across multiple tenants, a single authenticated attacker can deny service to all concurrent users. VulnCheck reported this with a CVSS 4.0 score of 7.1; no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Upgrade to vLLM 0.28.0 or later, which introduces validation of audio sample rate headers in the transcription endpoint. The vendor-released patch is confirmed at version 0.28.0 per the GitHub security advisory GHSA-99f2-hwrc-gvq8. If immediate upgrade is not feasible, restrict access to the transcription endpoint at the network or API gateway layer to trusted, verified clients only - this reduces exposure without eliminating the underlying flaw. Additionally, enforcing request-size and rate limits upstream (e.g., via reverse proxy or load balancer) can slow exploitation but will not prevent a determined authenticated attacker from triggering the allocation. Disabling the transcription feature entirely if not required is the most conservative workaround.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vLLM (cpe:2.3:a:vllm-project:vllm) is a high-throughput open-source LLM inference and serving engine that includes an audio transcription endpoint supporting FLAC-format input. FLAC headers carry metadata fields including sample rate; the server is expected to use this value when allocating memory buffers for decoded audio. CWE-409 (Improper Handling of Highly Compressed Data - Data Amplification) applies here because a crafted FLAC header can specify an arbitrarily large sample rate that causes the server to allocate a disproportionately large memory buffer relative to the actual payload size, exhausting process memory without requiring a proportionally large upload. The root cause is missing upper-bound validation on the sample rate field before it is used in resource-sizing calculations.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable endpoint, low complexity, authenticated (PR:L); availability-only impact; scope unchanged as crash stays within the vLLM process boundary.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.
Technical POC Analysis
Evidence caveat: the supplied advisory lists this as Moderate, CVSS v3.1 6.5, "No known CVE", with CWE-409 plus CWE-807 and CWE-1284.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
vLLM's transcription endpoint (versions before 0.28.0) is vulnerable to denial-of-service attacks where authenticated users can crash the entire shared server by uploading crafted FLAC audio files with forged headers. In multi-tenant environments, a single legitimate API user can disable service for all concurrent customers. This poses critical operational risk for organizations operating vLLM as a shared platform.
No vendor-released patch identified at time of analysis. Implement strict API authentication with regular key rotation schedules; enforce request-size caps and stream timeouts at the ingress layer; deploy resource and memory monitoring with auto-recovery triggers; isolate vLLM instances per tenant or customer where architecturally feasible; perform codec-level validation on audio file headers before processing; maintain detailed request logging to support incident response.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB