September 4th, 2026
Version 15.19.0 is now available for Batch Container, Realtime Container, GPU Transcription Inference Container and GPU Translation Inference Container.
Disfluency detection and removal now supports 16 additional languages: Arabic, Danish, Dutch, French, German, Greek, Hebrew, Hindi, Hungarian, Italian, Japanese, Mandarin, Polish, Portuguese, Russian, Spanish. See the documentation for more details.
Realtime transcript messages (AddTranscript, AddPartialTranscript, and EndOfUtterance) now include a forced flag, allowing clients to identify transcripts generated by a forced end of utterance.
New sm-gpu-inference-server-all-lang image is now available and supports all languages for both Standard and Enhanced models. See the documentation for more details.
New SM_LANGUAGES environment variable on the inference server entrypoint. Set it to a comma-separated list of language codes (e.g. SM_LANGUAGES=en,de,fr) to load only that subset of the image's baked-in language models at startup, instead of all of them. When unset, all languages are loaded (unchanged behaviour). An unknown language code fails startup with an error.
Improved accuracy (reduced deletions at end of utterance) when using ForceEndOfUtterance, with specific values of max_delay.
Reduced latency between a client-triggered ForceEndOfUtterance and final transcripts arriving.
Japanese smart formatting no longer fails on decimal money amounts (e.g. 十二 点 三 兆 円), which were previously left spelled out instead of being formatted as 12.3兆円.
remove_disfluencies no longer leaves orphan punctuation (for example a dangling . or ,) where filler words were removed.
Software Bill of Materials (SBOM) is available for download from the corresponding release page in our Support Portal.
OpenVEX statements are also available for each image, download from the corresponding release page in our Support Portal. These encode our assessment of CVEs that don't affect this release.
The following components were updated across 15.15.0–15.19.0 to address known vulnerabilities:
ffmpeg updated to 9.0.1 (CVE-2026-8461, CVE-2026-66041)
gstreamer updated to 1.28.6 (CVE-2026-3083, CVE-2025-2759, CVE-2026-3085, CVE-2025-3887)
libc6 and libc-bin updated to 2.39-0ubuntu8.8
python-multipart updated to 0.0.31
pyOpenSSL updated to 26.4.0, resolving cryptography to 50.0.0 (CVE-2026-69247, CVE-2026-69249)
sh (Python package) updated (CVE-2026-54552)
transformers updated to 5.5.0 (CVE-2026-4372, CVE-2026-5241), with regex updated to 2025.10.22
wheel and setuptools removed from the inference server (CVE-2026-24049, CVE-2024-6345, CVE-2025-47273)
cuda-compat-13-0 updated to 580.159.03-1ubuntu1
Debian packages libnss3, libgcrypt20, libcurl3t64-gnutls and libnghttp2-14 updated
The CVEs identified against the Triton Inference Server in the GPU Transcription Inference and GPU Translation Inference images (CVE-2026-47627, CVE-2026-47628, and CVE-2026-47629) are tracked as known issues and will be addressed by a Triton upgrade in a future release.
How to read these tables. Each row is keyed by the package a scanner attributes the advisory to. That attribution comes from the distribution's own security tracker rather than from the advisory's subject, so where an advisory concerns a component bundled by a different project, the tracker may attribute it to a package this image does ship even though the vulnerable component itself is not present. Scanner coverage also differs: not every row below is reported by every tool.
The following vulnerabilities are fixed in the versions this release ships. Scanners that identify a package by the distribution's own records will continue to report them, because those records track the distribution's package version rather than the version installed here.
The following vulnerabilities were reviewed and determined to have no security impact for this release.
These assessments assume the inference server APIs are reachable only from Speechmatics transcriber containers within your deployment. If you expose them to other clients, review the relevant Nvidia security bulletin directly.
The following vulnerabilities were reviewed and do apply to this release, with no fix released upstream at the time of writing. They are tracked and will be taken up when a fix becomes available.
Not every finding a scanner reports is listed individually above; the aggregated low-severity tail and a small number of findings still under review are not. The OpenVEX documents attached to each release are the authoritative per-CVE record.