PatchSiren

Vllm CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Vllm CVE published 2026-04-02

CVE-2026-34760

CVE-2026-34760 describes an audio-processing integrity issue in environments using vLLM with Librosa: mono downmixing defaults to numpy.mean, while ITU-R BS.775-4 calls for weighted downmixing. That mismatch can make audio interpreted by AI systems differ from what humans hear, creating inconsistent model inputs. The issue is assigned CVSS 5.9 (Medium) and is patched in vLLM 0.18.0.