July 7th, 2026

Batch Container

GPU Transcription Inference Container

1.3.0 - Melia 1 Containers

Version 1.3.0 is now available for the Melia 1 Container (Batch Transcriber and GPU Transcription Inference Container).

New

Introducing Melia 1 - our brand new model for multilingual transcription capable of handling production-scale traffic for multilingual use cases. Refer to the documentation for more details.

Melia 1 allows us to transcribe any of our 55+ languages without having to specify languages up front. Accuracy is already superior to our Standard model while offering lower processing costs.

Key features

  • Multilingual transcription with language labelling

  • Code-switching between languages, particularly when switching between English and Spanish, Arabic, Mandarin, Malay or Tamil.

  • Optional language hints

  • Blazingly fast turnaround time

Security fixes

Vulnerability management

  • Software Bill of Materials (SBOM) is available for download from the corresponding release page in our Support Portal.

  • OpenVEX statements are also available for each image, download from the corresponding release page in our Support Portal. These encode our assessment of CVEs that don't affect this release.

Non-applicable CVEs

The following vulnerabilities were reviewed and determined to have no security impact for this release.

Container

Component

Identified CVEs

Reason

Transcriber

libgstreamer

CVE-2025-3887

Manually patched (build 1.24.2-sm-1320260); scanners may still flag it because the base version string remains unchanged

Transcriber

ffmpeg and bundled codec libraries (libopenexr, libmfx1, libde265, libzvbi, libopenh264, libopenjp2, libvo-amrwbenc, libsndfile)

Multiple CVEs — see attached OpenVEX file for full per-CVE list

False positives: most stem from scanners matching against an older ffmpeg version tracker rather than the newer Speechmatics build (8.1.1) actually shipped; the rest are codec paths (video encode/decode, teletext, JPEG2000, etc.) never invoked by our audio-only decode-to-WAV pipeline

Transcriber

transformers

CVE-2026-4372, CVE-2026-1839

Deployed code only uses tokenization (AutoTokenizer/AutoConfig) on bundled files; the vulnerable model-load path is never invoked

Transcriber

python3-pip (vendored urllib3/requests)

CVE-2024-35195, CVE-2025-66418, CVE-2025-66471, CVE-2026-21441, CVE-2026-1703

Build/install-time only, not on any runtime path

Transcriber

libsoup-3.0-0 / libsoup-3.0-common

CVE-2025-14523, CVE-2025-32049, CVE-2025-4035, CVE-2026-0716, CVE-2026-0719, CVE-2026-3632, CVE-2026-3633, CVE-2026-3634, CVE-2025-9901, CVE-2026-3099

Not used by any pipeline; outbound HTTP uses the Python requests/urllib3 stack

Transcriber

libp11-kit0

CVE-2026-13757

p11-kit RPC server/proxy not used

Transcriber

glib-networking family

CVE-2026-10028

TLS backend reached only via libsoup, which no pipeline uses

Transcriber

libcurl3t64-gnutls

CVE-2026-11856, CVE-2026-10536, CVE-2026-12064

No SMB usage and no gstreamer-curl plugin in any pipeline; outbound HTTP uses the Python requests/urllib3 stack

GPU Inference Server

libcurl3t64-gnutls

CVE-2026-11856, CVE-2026-8925, CVE-2026-8927, CVE-2026-10536, CVE-2026-12064, CVE-2026-8286, CVE-2026-8458, CVE-2026-8924, CVE-2026-9547

Orphan package (empty reverse-dependency set); no installed runtime component links or invokes it

GPU Inference Server

setuptools, wheel

CVE-2024-6345, CVE-2025-47273, CVE-2026-24049

Base-image packaging tooling not invoked at inference runtime

GPU Inference Server

transformers

CVE-2026-4372, CVE-2026-1839

Only the fast tokenizer is used; the checkpoint-deserialization/model-load path is never invoked