{
 "id": "AIR-2026-0107",
 "slug": "cve-2026-90554-vllm-audio-decode-size-limit-vulnerability",
 "title": "CVE-2026-90554: vLLM audio decode size limit vulnerability",
 "summary": "vLLM fails to apply audio decode-size or duration limits when extracting audio from video inputs in NanoNemotronVL models. This flaw can be leveraged by attackers supplying specially crafted video inputs to cause excessive resource consumption.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "vLLM"
 ],
 "incident_date": "2026-09-12",
 "incident_date_precision": "day",
 "first_reported": "2026-09-12",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90554",
   "publisher": "NVD",
   "title": "CVE-2026-90554: vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input…",
   "published_at": "2026-09-12"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-90554",
  "vllm",
  "denial-of-service"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}