vLLM — transcription-endpoint duration-check bypass via forged FLAC sample-rate headers

vLLM versions before 0.28.0 fail to validate audio sample-rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks by submitting forged FLAC headers with inflated sample rates. This triggers excessive memory allocation and can crash the API server process, a denial-of-service condition distinct from the related NanoNemotronVL video/audio flaw (CVE-2026-90554).

Transcription/audio endpoints are a common feature of production vLLM deployments; an authenticated but otherwise unprivileged client can crash the shared inference server with a small crafted audio file, denying service to all other tenants of that instance.

Authenticated client submits a crafted FLAC file with a forged/inflated sample-rate header to the transcription endpoint, bypassing duration validation and forcing excessive memory allocation.

vLLM < 0.28.0

Upgrade to vLLM 0.28.0 or later, which validates audio sample-rate headers against actual duration before allocation.