CVE-2026-54234: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal

vLLM (a system for running LLMs efficiently) versions before 0.24.0 have a bug where certain requests can cause the rejection sampler (a component that filters generated tokens) to produce an invalid token value that crashes the engine's GPU worker. Because these requests can be sent remotely through public endpoints, an attacker can trigger this crash to shut down the service for all users until the worker restarts, creating a denial of service attack (making a service unavailable to legitimate users).