CVE-2026-90555: Vllm Vllm DOS Vulnerability

CVE-2026-90555 Overview

CVE-2026-90555 is a denial-of-service vulnerability in vLLM, an open-source inference and serving engine for large language models. Versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint. Authenticated clients can submit forged FLAC headers with inflated sample rates to bypass duration checks. The malformed input triggers excessive memory allocation and crashes the API server process. The crash affects every tenant sharing the vLLM instance, not just the attacker. The weakness is tracked under CWE-409: Improper Handling of Highly Compressed Data (Data Amplification).

Critical Impact
A single authenticated request can terminate the vLLM API server, disrupting inference for all tenants on the affected instance.

Affected Products

vLLM versions prior to 0.28.0
Multi-tenant deployments exposing the transcription endpoint
Self-hosted vLLM API servers accepting audio input

Discovery Timeline

2026-09-12 - CVE-2026-90555 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90555

Vulnerability Analysis

vLLM exposes a transcription endpoint that accepts audio files for speech-to-text inference. The server reads audio metadata to enforce a maximum duration before allocating buffers for decoding. The duration check relies on values extracted from the client-supplied audio header rather than from independently verified stream data. When the reported sample rate is inflated, the computed duration remains within limits while the actual memory required for decoding grows to unbounded sizes. The server then attempts to allocate buffers proportional to the forged parameters and terminates when allocation fails or the operating system kills the process.

Root Cause

The root cause is trust in untrusted input. The transcription pipeline uses header fields from FLAC uploads to gate resource allocation, but it never cross-validates those fields against the actual encoded frame data. The result is a classic data-amplification pattern where a small input causes disproportionately large processing costs.

Attack Vector

Exploitation requires network access to the vLLM API and valid client credentials. An attacker crafts a FLAC file whose header advertises a very high sample rate while the payload itself is small. Submitting this file to the transcription endpoint triggers the amplification path. Because vLLM serves multiple tenants from a single process, the resulting crash denies service to all users of the instance until the process restarts.

No verified public proof-of-concept has been published. See the GitHub Security Advisory GHSA-99f2-hwrc-gvq8 and the VulnCheck Denial of Service Advisory for further technical detail.

Detection Methods for CVE-2026-90555

Indicators of Compromise

Repeated crashes or unexpected restarts of the vLLM API server process shortly after transcription requests.
FLAC uploads to the transcription endpoint whose declared sample rate exceeds standard values such as 48000 or 96000 Hz.
Sudden memory spikes on the inference host correlated with /v1/audio/transcriptions requests.

Detection Strategies

Inspect audio upload metadata at an application-layer proxy and reject sample rates outside expected bounds before requests reach vLLM.
Correlate authenticated API client identifiers with process termination events to identify tenants generating crash-inducing traffic.
Alert on repeated OOMKilled events or non-zero exit codes for vLLM containers.

Monitoring Recommendations

Track memory allocation rates for the vLLM worker process and set thresholds that fire before the OOM killer intervenes.
Log the size, declared sample rate, and duration of every audio submission for post-incident review.
Monitor API availability from an external synthetic probe to detect tenant-wide outages quickly.

How to Mitigate CVE-2026-90555

Immediate Actions Required

Upgrade vLLM to version 0.28.0 or later on all inference hosts.
Restrict access to the transcription endpoint to trusted client identities until the upgrade is completed.
Rotate or scope down API credentials used by low-trust tenants sharing the affected instance.

Patch Information

The vLLM project addressed the issue in version 0.28.0. Refer to the GitHub Security Advisory GHSA-99f2-hwrc-gvq8 for the fix commit and release notes.

Workarounds

Place a reverse proxy in front of vLLM that parses and validates FLAC headers, rejecting sample rates above expected values such as 48000 Hz.
Enforce strict request size limits and per-tenant rate limiting on the transcription endpoint.
Isolate high-risk tenants on dedicated vLLM instances to contain the blast radius of a crash.
Configure the container runtime to restart vLLM automatically and cap memory to bound damage from a successful attack.

bash

# Configuration example
pip install --upgrade "vllm>=0.28.0"

# Verify installed version
python -c "import vllm; print(vllm.__version__)"