Skip to content
OpenAdvisories
Medium · 6.9 CVE-2026-54235 EUVD-2026-38402GHSA-7h4p-rffg-7823PYSEC-2026-3405

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

Published Jun 22, 2026 · Updated Jun 23, 2026 · Assigned by GitHub_M

Description

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (<, >), which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagate to GPU sampling kernels, where they produce undefined behavior or CUDA errors that can crash the inference worker. This vulnerability is fixed in 0.23.1rc0.

Affected products

VendorProductAffectedFixed
vllm-project vllm < 0.23.1rc0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI vllm >= 0.8.5, < 0.24.0 0.24.0 GHSA-7h4p-rffg-7823
PyPI vllm <= 0.23.0 — PYSEC-2026-3405

Advisories 1

References