{
 "id": "AIR-2026-1376",
 "slug": "cve-2026-90555-vllm-audio-transcription-memory-exhaustion",
 "title": "CVE-2026-90555: vLLM Audio Transcription Memory Exhaustion",
 "summary": "vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint. Authenticated clients can submit forged headers to trigger excessive memory allocation and crash the server.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "vLLM"
 ],
 "incident_date": "2026-09-12",
 "incident_date_precision": "day",
 "first_reported": "2026-09-12",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90555",
   "publisher": "NVD",
   "title": "CVE-2026-90555: vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated…",
   "published_at": "2026-09-12"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-90555",
  "dos",
  "vllm"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}