CVE-2026-90555

Executive Summary

CVE-2026-90555 is a denial-of-service vulnerability (CWE-409 — Improper Handling of Highly Compressed Data) in the vLLM inference server affecting all versions before 0.28.0. The transcription endpoint fails to validate the audio sample rate declared in submitted audio file headers, allowing an authenticated client to bypass duration checks by forging FLAC headers with inflated sample rate values. Successful exploitation triggers excessive memory allocation, terminating the API server process and causing a full outage for all tenants sharing that instance. CVSS 3.1 score is 6.5 (Medium), with availability impact rated High (A:H) and no confidentiality or integrity impact (C:N/I:N/A:H).

Technical Analysis

vLLM is an open-source high-throughput inference and serving engine for large language models, frequently deployed as an autoscaling API server in multi-tenant ML platforms. The vulnerable component is the transcription endpoint, which accepts audio uploads (notably FLAC) and derives processing duration from header-declared parameters. The core flaw is that the server trusts the client-supplied sample rate in the FLAC header instead of validating it against a sane maximum, or cross-checking it against the actual decoded stream. Because duration checks are calculated from the declared sample rate, an attacker can inflate the sample rate field to make a short audio payload appear to represent far more audio than it does, or otherwise bypass the maximum-duration gate.

When the duration check is bypassed, downstream buffer/memory allocation for the transcription pipeline is sized based on the forged metadata rather than the actual content. This results in excessive memory allocation proportional to the inflated duration value. Under load or with a sufficiently aggressive forged header, the allocation exhausts available process memory, and the API server process crashes. The request requires authentication (PR:L), lowering the barrier for any legitimate or compromised low-privilege user but ruling out unauthenticated internet-wide mass exploitation. Attack is network-reachable (AV:N), no user interaction (UI:N) and no privileges beyond a valid account are needed.

No public proof-of-concept, Nuclei template, or exploit code is available. No affected version package list has been published to OSV, and no vendor advisory has been released. The technical mechanism is therefore inferred from the NVD description and vulnerability class (CWE-409) only; no specific function names, class names, parameter names, or file paths should be assumed beyond the "transcription endpoint" and "FLAC header" elements explicitly named in the description.

Because CWE-409 covers improper handling of highly compressed data, the attack should be understood as an input-metadata trust failure: the parser accepts attacker-controlled size/rate fields that drive resource consumption without bounds. This class of bug is a classic availability defect in media-processing and ML-serving pipelines.

Exploitation Scenarios

The following attack chain is inferred strictly from the NVD description and the CWE-409 vulnerability class. No specific request paths, handler names, or code identifiers are fabricated here beyond what the description explicitly names.

1. Reconnaissance / target identification. The attacker identifies a vLLM instance exposing a transcription/audio API and determines that it is below version 0.28.0. In multi-tenant deployments, the endpoint is commonly reachable to authenticated clients; the attacker needs only valid API credentials (PR:L), which may be their own tenant account or a compromised low-privilege key.

2. Triggering the flaw class. The attacker crafts an audio file — described as a forged FLAC header — in which the sample rate field is set to an inflated value. Because the server does not validate the audio sample rate header, its duration check derives an unrealistic duration from this forged metadata, allowing the check to be bypassed (per the description, "bypass duration checks").

3. Payload / execution. The attacker submits the forged FLAC file to the transcription endpoint while authenticated. The server sizes its memory allocation from the forged parameters, producing excessive memory allocation. Depending on magnitude and repeatability, this either exhausts available memory immediately or accumulates across requests until resource limits are hit.

4. Post-exploitation impact. The inflated allocation crashes the API server process. Because vLLM instances typically serve all tenants on a given deployment, the crash is a cross-tenant availability event: all users lose inference/transcription service for the duration of the outage and restart. No data is exfiltrated (C:N) and no data is modified (I:N); the impact is purely availability (A:H).

No public PoC is available; the chain above is derived from the vulnerability class and stated NVD behavior. Attackers would need only moderate skill to script repeated submissions.

Impact Assessment

• CVSS 3.1 Base: 6.5 (Medium) — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
• Attack Vector (N): remotely reachable over the network.
• Attack Complexity (L): low; a forged FLAC header is trivially reproducible.
• Privileges Required (L): valid low-privilege authentication needed.
• User Interaction (N): none — no victim action is required.
• Scope (U): the base scope is unchanged; however, since a single crash affects all tenants on the shared server, real-world blast radius is broad within the deployment.
• Confidentiality (N) / Integrity (N): no data exposure or tampering.
• Availability (H): total loss of the API server process.

Business impact: transcribing, inference, and dependent application flows on the affected node become unavailable until the process restarts. In multi-tenant SaaS deployments, a single malicious or compromised tenant can repeatedly induce outages, causing SLA violations, support escalation, and revenue loss. Sustained repetition could constitute an availability-degradation campaign against an ML platform or a noisy-suppression tactic to mask alternative activity.

Detection Guidance

Sigma Rule

title: vLLM Transcription Endpoint Forged FLAC Sample Rate DoS id: 5f3a9c1e-7b2d-4c8a-9e11-2a4d6f0b1c3d status: experimental description: Detects submission of audio/FLAC files to a vLLM transcription endpoint with abnormally inflated sample-rate values, consistent with CVE-2026-90555 duration-check bypass and memory-exhaustion DoS. references:

• https://nvd.nist.gov/vuln/detail/CVE-2026-90555 author: valtersit.com date: 2026/01/01 logsource: category: webserver detection: selection_path: cs-method: POST cs-uri-path|contains: 'transcriptions' selection_audio: cs-content-type|contains:
  • 'audio/flac'
  • 'audio/x-flac'
  • 'multipart/form-data' selection_bad_rate:
  • cs-request-body|contains|all:
    • 'sample_rate'
    • '>='
  • cs-request-body|re: 'sample_rate[^0-9]{0,3}(1[0-9]{5,}|[2-9][0-9]{4,})' condition: selection_path and selection_audio and selection_bad_rate falsepositives:
• Legitimate high-sample-rate studio recordings (rare for FLAC headers) level: high tags:
• attack.impact
• attack.t1499
• cve.2026.90555

YARA Rule

rule CVE_2026_90555_vLLM_Forged_FLAC_SampleRate
{
    meta:
        author = "valtersit.com"
        description = "Detects forged FLAC headers with inflated sample rate indicative of CVE-2026-90555 against vLLM transcription endpoint"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90555"
        date = "2026-01-01"
        severity = "high"

    strings:
        $flac_magic = { 66 4C 61 43 }              // "fLaC"
        $streaminfo = "STREAMINFO"
        $ct_flac1 = "audio/flac"
        $ct_flac2 = "audio/x-flac"
        $path_tr  = "/transcriptions"
        $sr       = "sample_rate"
        $sr2      = "sample-rate"
        $rate_big = "96000"
        $rate_big2 = "192000"
        $rate_big3 = "384000"
        $rate_big4 = "768000"

    condition:
        uint32be(0) == 0x664C6143 or
        (
            ($flac_magic or $streaminfo) and
            ($ct_flac1 or $ct_flac2 or $path_tr) and
            ($sr or $sr2) and
            ($rate_big or $rate_big2 or $rate_big3 or $rate_big4)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90555 vLLM Transcription Forged FLAC Sample Rate DoS Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"transcriptions"; http.header; content:"Content-Type"; content:"flac"; nocase; file.data; content:"fLaC"; depth:4; file.data; content:"sample_rate"; pcre:"/(?:96000|192000|384000|768000)/"; reference:cve,2026-90555; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-90555; classtype:attempted-dos; sid:202690555; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, mitre_tactic_id T1499, mitre_tactic_name Endpoint_Denial_of_Service;)

Elastic Detection

sequence by process.entity_id with maxspan=30s [ network where network.protocol == "http" and http.request.method == "POST" and http.request.body.bytes > 100000 and (http.request.mime_type in ("audio/flac","audio/x-flac")) ] [ logs where event.category == "process" and event.action in ("crashed","terminated-by-signal") and process.name like ("python*","vllm*") and message like ("MemoryError","malloc","OOM","Killed") ]

Splunk SPL Query

index=web OR index=app sourcetype=access_combined OR sourcetype=vllm:server | eval is_transcription=if(like(uri, "%transcriptions%"), 1, 0) | eval is_flac=if(like(content_type, "%flac%") OR like(content_type, "%audio%"), 1, 0) | where is_transcription=1 AND is_flac=1 | eval bad_rate=if(match(request_body, "(?i)sample[_-]?rate[^0-9]{0,4}(96000|192000|384000|768000|[1-9][0-9]{5,})"), 1, 0) | stats count, values(uri) as endpoints, values(src_ip) as attacker_ip, max(bytes) as max_body by user, clientip, bad_rate | where bad_rate=1 OR count > 20 | sort - count | table clientip, attacker_ip, user, endpoints, count, max_body, bad_rate

Wazuh OSSEC Rule

31100 transcriptions CVE-2026-90555 - vLLM transcription endpoint access detected 2026551 sample[_-]?rate.{0,6}(96000|192000|384000|768000) CVE-2026-90555 - Forged FLAC sample rate submitted to vLLM transcription endpoint (possible DoS) T1499 2026551 MemoryError|OutOfMemory|Cannot allocate memory CVE-2026-90555 - vLLM API server experiencing excessive memory allocation/crash after transcription request T1499

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (no vendor patch available):

• Restrict the transcription endpoint to trusted clients via network controls (private ingress, mTLS, allowlist) and enforce strict per-tenant authentication and rate limits.
• Enforce a maximum request body size and request-rate cap at the reverse proxy/API gateway to reduce the reachable allocation boundary.
• Validate audio metadata server-side by comparing the declared sample rate against the decoded stream; until patched, apply a WAF/proxy rule that rejects FLAC uploads whose declared sample_rate exceeds realistic maxima.
• Isolate transcription workloads from shared critical inference processes (separate worker/service) so a crash affects only the transcription component rather than all tenants.
• Set memory limits and health-check-based automatic restart to contain the blast radius of a crash.

2. Patch/upgrade steps:

• Monitor NVD and the vLLM project for the release of version 0.28.0, which per the NVD description resolves the missing sample-rate validation.
• Upon release, upgrade the package and restart all vLLM serving instances; re-validate that transcription duration checks enforce server-derived values.
• No vendor advisory or workaround has been published as of this report.

3. Long-term hardening:

• Treat all client-supplied media metadata as untrusted; derive resource allocation from decoded content, never from declared headers.
• Add input size/duration ceilings and fuzz the transcription parser as part of CI.
• Adopt version pinning and prompt patch cadence for ML-serving infrastructure; monitor dependencies for CWE-409-class issues.

References

• NVD — CVE-2026-90555: https://nvd.nist.gov/vuln/detail/CVE-2026-90555
• CWE-409 — Improper Handling of Highly Compressed Data: https://cwe.mitre.org/data/definitions/409.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• vLLM project (monitor for v0.28.0 release / advisory): https://github.com/vllm-project/vllm
• FIRST EPSS (score not yet published; check for updates): https://www.first.org/epss/

Threat actor campaign / exploit-in-the-wild evidence: None identified. CISA KEV status: NOT listed. No public PoC, Nuclei template, or exploit code exists as of this report.

◈ SOURCE Analysis & enrichment: valtersit.com/cve/CVE-2026-90555/ · CVE data: NVD/MITRE (public domain) · © 2026 ValtersIT Hub