CVE-2026-54234 Details
Description
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into the drafter's input ids; that out-of-vocabulary value is later consumed by the model's embedding and attention path and crashes the engine worker with a GPU device-side assertion. The same triggering request sequence is reachable through the public gRPC Generate and Abort endpoints, so a remote client that can send generation requests can crash the shared engine worker, aborting concurrent requests and causing a service-wide denial of service for other clients of the deployment until the worker is restarted. This issue is fixed in version 0.24.0.
A denial-of-service vulnerability has been identified in vLLM, an inference and serving engine for large language models, prior to version 0.24.0. The issue arises in a multi-request speculative decoding workload, where the rejection sampler can produce an out-of-vocabulary token equal to the model's vocabulary size. This token is then converted to -1 and reinjected into the input IDs for the next request. When this invalid token is processed by the model's embedding and attention mechanisms, it triggers a GPU device-side assertion, causing the engine worker to crash. The vulnerability can be exploited remotely through the public gRPC Generate and Abort endpoints, leading to a service-wide denial-of-service condition for other clients until the worker is restarted.
Users can upgrade to vLLM version 0.24.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vllm-project/vllm/security/advisories/GHSA-8wr5-jm2h-8r4f | CISA-ADP | Vendor AdvisoryExploit |
| https://github.com/vllm-project/vllm/commit/8a5cf1ccd65e8ac7635c402c1ec0b08988bc26ca | [email protected] | Patch |
| https://github.com/vllm-project/vllm/pull/44744 | [email protected] | Issue TrackingPatch |
| https://github.com/vllm-project/vllm/security/advisories/GHSA-8wr5-jm2h-8r4f | [email protected] | Vendor AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vllm vllm | < 0.24.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | [email protected] |