CyberRota Analysis
AI-GeneratedVersions of vLLM prior to 0.28.0 are vulnerable due to inadequate validation of audio sample rate headers in the transcription endpoint, enabling authenticated users to bypass duration checks. This flaw allows attackers to submit manipulated FLAC headers, potentially leading to excessive memory allocation and crashing the API server, impacting all tenants. Organizations using vLLM should prioritize patching to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.