Tools AI Risk Radar ai-incident-0220
Incident record
vLLM fixes a crafted-audio crash in transcription
- Severity
- Medium
- Status
- Patched
- Type
- Infra Vuln
- Target
- vLLM before 0.29.0
- Actor
- researcher
- CVE
- CVE-2026-109311
What happened
A crafted IAMF audio upload can reach a native decoder overflow and crash the transcription service. Authentication is required where an API key is configured.
The maintainer’s 28 September advisory identifies 0.29.0 as fixed and rates the demonstrated denial of service CVSS 3.1 6.5 Medium. The CNA published a separate CVSS 4.0 rating of 7.1 on 12 October.
Sources
- Original advisory or disclosuregithub.com/vllm-project/vllm/security/advisories/GHSA-m52c-3…
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-109311
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026