PT-2026-29877 · Vllm+2 · Vllm+2

Kexinoh · Published 2026-04-02 · Updated 2026-05-11 · CVE-2026-34760

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions vLLM versions 0.5.5 through 0.17.999

Description vLLM, an inference and serving engine for large language models (LLMs), exhibits an inconsistency in audio processing. Versions 0.5.5 through 0.17.999 utilize numpy.mean for mono downmixing via Librosa, deviating from the ITU-R BS.775-4 weighted downmixing standard. This discrepancy causes differences in audio perception between human listeners and AI models that process audio using Librosa.

Recommendations Update to version 0.18.0 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-34760

Affected Products

Librosa

Numpy

Vllm

References · 7

• https://github.com/vllm-project/vllm/commit/c7f98b4d0a63b32ed939e2b6dfaa8a626e9b46c4 · Patch
• https://github.com/vllm-project/vllm/security/advisories/GHSA-6c4r-fmh3-7rh8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34760 · Security Note
• https://github.com/vllm-project/vllm/pull/37058 · Note
• https://github.com/vllm-project/vllm/releases/tag/v0.18.0 · Note
• https://twitter.com/CVEnew/status/2040128777062125993 · Twitter Post
• https://t.me/cveNotify/163037 · Telegram Post