# CVE-2026-90555

## Summary

- **CVE ID:** CVE-2026-90555
- **Severity:** HIGH
- **CVSS Score:** 7.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
- **CWE:** CWE-409
- **Published:** Sep 12, 2026
- **Last Modified:** Sep 14, 2026

## Description

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.

## Affected Products

- vllm-project — vLLM (0)
- vllm-project — vLLM (0.28.0)

## References

- [CNA](https://github.com/vllm-project/vllm/security/advisories/GHSA-99f2-hwrc-gvq8)
- [CNA](https://www.vulncheck.com/advisories/vllm-before-0.28.0-denial-of-service-via-audio-header)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.29%
- **EPSS Percentile:** 22.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._