CVE-2026-34760

vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa defaults to using numpy.mean for mono downmixing (to_mono), while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results in inconsistency between audio heard by humans (e.g., through headphones/regular speakers) and audio processed by AI models (Which infra via Librosa, such as vllm, transformer). This issue has been patched in version 0.18.0.

• CWE-20

• https://github.com/vllm-project/vllm/commit/c7f98b4d0a63b32ed939e2b6dfaa8a626e9b46c4Patch
• https://github.com/vllm-project/vllm/pull/37058Issue Tracking
• https://github.com/vllm-project/vllm/releases/tag/v0.18.0Release Notes
• https://github.com/vllm-project/vllm/security/advisories/GHSA-6c4r-fmh3-7rh8Vendor Advisory

Published

Apr 2, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34755vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-34756vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-34757LIBPNG is a reference library for use in applications that r…4.4
• CVE-2026-34758OneUptime is an open-source monitoring and observability pla…9.1
• CVE-2026-34759OneUptime is an open-source monitoring and observability pla…8.1
• CVE-2026-3476A Code Injection vulnerability affecting SOLIDWORKS Desktop …7.8
• CVE-2026-34761Ella Core is a 5G core designed for private networks. Prior …6.5
• CVE-2026-34762Ella Core is a 5G core designed for private networks. Prior …2.7
• CVE-2026-34763Rack is a modular Ruby web server interface. Prior to versio…5.3
• CVE-2026-34764Electron is a framework for writing cross-platform desktop a…5.5
• CVE-2026-34765Electron is a framework for writing cross-platform desktop a…8.8
• CVE-2026-34766Electron is a framework for writing cross-platform desktop a…5.4