vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa defaults to using numpy.mean for mono downmixing (to_mono), while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results in inconsistency between audio heard by humans (e.g., through headphones/regular speakers) and audio processed by AI models (Which infra via Librosa, such as vllm, transformer). This issue has been patched in version 0.18.0.
References
| Link | Resource |
|---|---|
| https://github.com/vllm-project/vllm/commit/c7f98b4d0a63b32ed939e2b6dfaa8a626e9b46c4 | Patch |
| https://github.com/vllm-project/vllm/pull/37058 | Issue Tracking |
| https://github.com/vllm-project/vllm/releases/tag/v0.18.0 | Release Notes |
| https://github.com/vllm-project/vllm/security/advisories/GHSA-6c4r-fmh3-7rh8 | Vendor Advisory |
Configurations
History
11 May 2026, 13:24
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Vllm vllm
Vllm |
|
| References | () https://github.com/vllm-project/vllm/commit/c7f98b4d0a63b32ed939e2b6dfaa8a626e9b46c4 - Patch | |
| References | () https://github.com/vllm-project/vllm/pull/37058 - Issue Tracking | |
| References | () https://github.com/vllm-project/vllm/releases/tag/v0.18.0 - Release Notes | |
| References | () https://github.com/vllm-project/vllm/security/advisories/GHSA-6c4r-fmh3-7rh8 - Vendor Advisory | |
| CPE | cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:* |
02 Apr 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-02 20:16
Updated : 2026-05-11 13:24
NVD link : CVE-2026-34760
Mitre link : CVE-2026-34760
CVE.ORG link : CVE-2026-34760
JSON object : View
Products Affected
vllm
- vllm
CWE
CWE-20
Improper Input Validation