{"data":{"id":"9db90a97-9702-48de-9fb4-c01e63c7cf9a","title":"CVE-2026-54234: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal…","summary":"CVE-2026-54234 affects vLLM before 0.24.0, an inference and serving engine for LLMs. A frontend-legal multi-request speculative decoding workload makes the rejection sampler emit a recovered token at the vocabulary size boundary, which becomes -1 and reaches the model's embedding and attention path, crashing the engine worker with a GPU device-side assertion. A remote client that can send requests through the public gRPC Generate and Abort endpoints can trigger this, aborting concurrent requests and causing a service-wide denial of service until the worker restarts.","solution":"Fixed in version 0.24.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54234","publishedAt":"2026-07-06T21:16:56.477Z","cveId":"CVE-2026-54234","cweIds":["CWE-20","CWE-1284"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["vllm@>= 0.17.1, < 0.24.0 (fixed: 0.24.0)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM denial of service through speculative decoding over gRPC Generate","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00616,"epssCheckedAt":"2026-10-14T12:12:43.169Z","kevDateAdded":null,"advisoryAliases":["GHSA-8wr5-jm2h-8r4f"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:47:01.057Z","patchAvailable":true,"disclosureDate":"2026-07-06T21:16:56.477Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}