USN-8863-1: GStreamer Good Plugins vulnerabilities

Yazan Balawneh discovered that GStreamer Good Plugins incorrectly handled certain FLAC audio streams. An attacker could possibly use this issue to obtain sensitive information. CVE-2026-17072 Seonwook Kim discovered that GStreamer Good Plugins incorrectly parsed certain AVI files. An attacker cou...

Rocky Linux 8.6 [CIQ] Security Update: flac / flac-debuginfo / flac-debugsource / flac-libs / etc (ciqsa-2026_0807)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260807 advisory. This advisory aggregates security fixes for the flac SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2020-22219. Tenable has extracted the preceding description bloc...

Rocky Linux 9 [CIQ] Security Update: flac / flac-debuginfo / flac-debugsource / flac-devel / flac-libs / etc (crlsa-2022_8078)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20228078 advisory. flac: out of bound write in appendtoverifyfifointerleaved of streamencoder.c CVE-2021-0561 Tenable has extracted the preceding description block directly from the C...

Rocky Linux 8 [CIQ] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-debuginfo / etc (crlsa-2024_3089)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243089 advisory. gstreamer-plugins-good: integer overflow leading to heap overwrite in FLAC image tag handling CVE-2023-37327 Tenable has extracted the preceding description block...

AlmaLinux 9.2 [TuxCare] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-gtk / etc (ALMALINUX9.2:CLSA-2025:1751141320)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751141320 advisory. - GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute...

Astra Linux – Vulnerability in gst-plugins-good1.0

GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack vectors may vary...

Astra Linux – Vulnerability in FLAC

A buffer overflow vulnerability exists in the function bitwritergrow in FLAC before version 1.4.0, allowing remote attackers to execute arbitrary code through crafted inputs to the encoder...

Astra Linux – Vulnerability in libsndfile

A out-of-bounds read flaw was discovered in the FLAC codec functionality of libsndfile. An attacker who can submit a specially crafted file by tricking a user into opening it or otherwise to an application that uses libsndfile and the FLAC codec, could trigger an out-of-bounds read. This would mo...

Astra Linux – Vulnerability in FLAC

In streamencoder.c, there is a potential out-of-bounds write due to a missing bounds check. This could lead to exposure of local information without requiring additional execution privileges. User interaction is not required for exploitation. Product: Android Versions: Android-11 Android ID:...

Astra Linux – Vulnerability in FLAC

In FLACbitreaderreadricesignedblock of bitreader.c, there is a potential out-of-bounds read due to a heap buffer overflow. This could lead to remote information disclosure without requiring additional execution privileges. User interaction is required for exploitation. Product: Android. Versions:...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in the transcription due to improper validation of audio sample rate headers. An...

CVE-2026-90555

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server proce...

CVE-2026-90555

A flaw was found in vLLM. An authenticated client can exploit this vulnerability by submitting forged FLAC Free Lossless Audio Codec headers with an inflated sample rate to the transcription endpoint. This bypasses duration checks, leading to excessive memory allocation within the API server...

EUVD-2026-76873

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server proce...

CVE-2026-90555 vLLM before 0.28.0 Denial of Service via Audio Header

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server proce...

CVE-2026-90555

vLLM versions before 0.28.0 contain a Denial of Service vulnerability in the transcription endpoint. The root cause is a failure to validate audio sample rate headers in submitted files. An authenticated attacker can bypass duration checks by submitting forged FLAC headers with inflated sample ra...

CVE-2026-90555 vLLM before 0.28.0 Denial of Service via Audio Header

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server proce...

CVE-2026-90555 vLLM before 0.28.0 Denial of Service via Audio Header

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server proce...

PT-2026-90660

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server proce...

CVE-2026-90555: Improper Handling of Highly Compressed Data (Data Amplification)

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server proce...