EUVD-2026-18522
GHSA-6c4r-fmh3-7rh8
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Impact | The CVSS v3.1 score of 5.9 (medium-high) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L indicates network-accessible attack requiring low privileges and high complexity, with high integrity impact and low availability impact. However, the real-world risk is constrained by several factors: (1) attack complexity is high, suggesting exploitation requires precise control of audio input and timing; (2) the vulnerability is tagged as Information Disclosure rather than code execution or authentication bypass, limiting immediate system compromise; (3) the integrity impact is conditional on audio-based model workflows being present and unvalidated; (4) EPSS and active exploitation data are not provided, but the public patch availability and GitHub advisory indicate this is a known, addressed issue rather than an emerging threat. The vulnerability is primarily relevant to organizations running vLLM with multimodal audio inputs where audio fidelity against standards is a compliance or security requirement. For organizations not processing audio through vLLM, risk is negligible. |
| Exploit ScenarioDerived | An authenticated attacker with low privileges in a multi-tenant vLLM deployment submits audio queries for inference where the audio content differs between stereo and mono representations under ITU-R standard (e.g., strong center-channel dialogue with quiet side-channel ambient sound). By exploiting vLLM's non-standard mono downmixing, the attacker crafts inputs where the model's audio perception deviates from human hearing, potentially causing the LLM to misinterpret audio content or generate incorrect outputs. This could be leveraged to poison audio-based training data, evade audio-based security checks, or demonstrate model reliability failures. High attack complexity indicates the attacker must have precise knowledge of the audio preprocessing pipeline and the specific audio characteristics that trigger the mismatch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
vLLM versions 0.5.5 through 0.17.x use incorrect mono audio downmixing via numpy.mean instead of the ITU-R BS.775-4 weighted standard, causing audio processed by AI models to diverge from human perception. An authenticated remote attacker with low privileges can exploit this inconsistency to manipulate audio-based model outputs or infer mismatches between expected and actual audio processing, affecting integrity of audio-driven inference pipelines. The vulnerability has been patched in vLLM 0.18.0.
RemediationAI
Vendor-released patch: vLLM 0.18.0. Organizations should upgrade vLLM to version 0.18.0 or later immediately. The fix corrects Librosa's audio preprocessing to conform to ITU-R BS.775-4 standard weighted downmixing. For those unable to upgrade immediately, workarounds include disabling Librosa-based audio preprocessing in vLLM configuration or pre-processing audio outside vLLM using standard-compliant libraries before inference. Refer to https://github.com/vllm-project/vllm/releases/tag/v0.18.0 for release details and https://github.com/vllm-project/vllm/pull/37058 for technical implementation notes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vLLM integrates Librosa for audio preprocessing in LLM inference workflows. Librosa's to_mono function defaults to simple arithmetic mean (numpy.mean) for converting stereo to mono audio, which differs from ITU-R BS.775-4 standard weighted downmixing used in consumer audio playback and human hearing. The root cause is improper input validation and normalization (CWE-20) of audio preprocessing parameters, allowing a mismatch between training/reference audio and inference audio representations. This affects any vLLM deployment processing audio tokens or multimodal audio inputs where Librosa-based preprocessing occurs. The CPE cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:* covers all vLLM instances in the affected range.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa defaults to using numpy.mean for mono downmixing (to_mono), while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results in inconsistency between audio heard by humans (e.g., through headphones/regular speakers) and audio processed by AI models (Which infra via Librosa, such as vllm, transformer). This issue has been patched in version 0.18.0.
Blast Radius
ecosystem impact- 2 pypi packages depend on vllm (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.5.5.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB