PT-2026-90660 · Vllm+1 · Vllm
CVSS v4.0
7.1
عالية
| المتجه | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
vLLM versions prior to 0.28.0
Description
Authenticated clients can bypass duration checks in the transcription endpoint because the system fails to validate audio sample rate headers. By submitting forged FLAC headers with inflated sample rates, an attacker can trigger excessive memory allocation, leading to a crash of the API server process that affects all tenants.
Recommendations
Update to version 0.28.0 or later.
استغلال
إصلاح
DoS
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Vllm