{"data":{"id":"36b43c03-af06-4667-948d-974b43d4d645","title":"GHSA-7h4p-rffg-7823: vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels","summary":"vLLM's temperature validation in sampling_params.py uses comparison operators that evaluate to False for NaN and positive Infinity, so both values pass every guard. These values reach GPU sampling kernels, where they cause undefined behavior or CUDA errors that can crash the inference worker and degrade service for all concurrent users. The source notes that -Infinity is correctly rejected.","solution":"Add math.isfinite(self.temperature) check in _verify_args(). Reject non-finite float values with a 400 error. A fix was merged in https://github.com/vllm-project/vllm/pull/45116","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-7h4p-rffg-7823","publishedAt":"2026-06-17T14:02:22.000Z","cveId":"CVE-2026-54235","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["vllm@<= 0.23.0"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0045,"epssCheckedAt":"2026-11-04T06:10:13.820Z","kevDateAdded":null,"advisoryAliases":["GHSA-7h4p-rffg-7823"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-06-17T14:02:22.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}