CVE-2026-54235
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (<, >), which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagate to GPU sampling kernels, where they produce undefined behavior or CUDA errors that can crash the inference worker. This vulnerability is fixed in 0.23.1rc0.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- EPSS probability
- 0.45%
- CWE
- CWE-1287
- Published
- 2026-06-22
- Last modified
- 2026-06-23
Affected products
- vllm-project vllm
Weakness type
Related vulnerabilities
- CVE-2026-86287 — Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths
- CVE-2026-52763 — YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read
- CVE-2026-59680 — yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute
- CVE-2026-82741 — Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion
- CVE-2026-80051 — github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar...
- CVE-2026-17113 — Cri-o: cri-o: unvalidated image env var causes daemon crash
- CVE-2026-5304 — An ACAP configuration file lacks input validation, which could potentially lead to privilege...
- CVE-2026-18830 — Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API