CVE-2026-54235 Details
Description
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (<, >), which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagate to GPU sampling kernels, where they produce undefined behavior or CUDA errors that can crash the inference worker. This vulnerability is fixed in 0.23.1rc0.
A vulnerability in vLLM, an inference engine for large language models, allows non-finite temperature values (NaN and positive Infinity) to bypass validation checks and propagate to GPU sampling kernels. This issue, present in vLLM versions through 0.8.5, can cause undefined behavior or CUDA errors that crash the inference worker, degrading service for all concurrent users. The root cause lies in the temperature validation logic, which fails to correctly handle these special float values due to Python's IEEE 754 semantics. As a result, NaN and positive Infinity are silently accepted, leading to crashes during GPU processing.
Users can update to vLLM version 0.23.1rc0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vllm-project/vllm/commit/d598d239737cfa37bcfcb98886ec3f3557fc7198 | [email protected] | Patch |
| https://github.com/vllm-project/vllm/pull/45116 | [email protected] | Issue Tracking |
| https://github.com/vllm-project/vllm/security/advisories/GHSA-7h4p-rffg-7823 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1287 | Improper Validation of Specified Type of Input | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vllm vllm | < 0.23.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |