Staging Environment: Content and features may be unstable or change without notice.
Advisory details: pypa / vllm/PYSEC-2026-2299
Advisory ID pypa/vllm/PYSEC-2026-2299
Aliases CVE-2026-34760
GHSA-6c4r-fmh3-7rh8
PYSEC-2026-2299
Summary vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa defaults to using numpy.mean for mono downmixing (to_mono), while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results in inconsistency between audio heard by humans (e.g., through headphones/regular speakers) and audio processed by AI models (Which infra via Librosa, such as vllm, transformer). This issue has been patched in version 0.18.0.
Status Published
Exploitability 0.5
Weighted Severity 6.4
Risk 3.2
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3.1 7.1 https://github.com/pypa/advisory-database/blob/main/vulns/vllm/PYSEC-2026-2299.yaml
Reference id Reference type URL
37058 Other https://github.com/vllm-project/vllm/pull/37058
c7f98b4d0a63b32ed939e2b6dfaa8a626e9b46c4 Other https://github.com/vllm-project/vllm/commit/c7f98b4d0a63b32ed939e2b6dfaa8a626e9b46c4
GHSA-6c4r-fmh3-7rh8 Other https://github.com/vllm-project/vllm/security/advisories/GHSA-6c4r-fmh3-7rh8
v0.18.0 Other https://github.com/vllm-project/vllm/releases/tag/v0.18.0
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Found at https://github.com/pypa/advisory-database/blob/main/vulns/vllm/PYSEC-2026-2299.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-03T14:42:25Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/34xxx/CVE-2026-34760.json

Source Advisory: vulnrichment/CVE-2026-34760

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]