Most recent entries from all

EUVD-2026-329184

fkie_cve-2026-54235

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (<, >), which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagate to GPU sampling kernels, where they produce undefined behavior or CUDA errors that can crash the inference worker. This vulnerability is fixed in 0.23.1rc0.

GHSA-7h4p-rffg-7823 — vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

Affected: PyPI: vllm

## Summary

All temperature validation gates use comparison operators (`<`, `>`), which silently evaluate to `False` for `NaN` and for positive `Infinity` in Python's IEEE 754 float semantics. Both values pass every guard and propagate to GPU sampling kernels, where they produce undefined behavior or CUDA errors that can crash the inference worker. Note: `-Infinity` is correctly caught.

## Root Cause

`sampling_params.py:384`: ```python if 0 < self.temperature < _MAX_TEMP: # NaN → False; +Inf → False ```

`sampling_params.py:462`: ```python if self.temperature < 0.0: # NaN → False; +Inf → False raise VLLMValidationError(...) ```

No `math.isnan()` or `math.isinf()` check exists anywhere in `sampling_params.py`.

Python semantics (verified): `float('nan') < 0.0` → `False`, `float('inf') < 0.0` → `False`.

## Impact

Crash of inference worker on GPU kernel execution with NaN/Inf softmax input, degrading service for all concurrent users.

## Remediation

Add `math.isfinite(self.temperature)` check in `_verify_args()`. Reject non-finite float values with a 400 error.

## Fix

A fix for this vulnerability was merged here: https://github.com/vllm-project/vllm/pull/45116

PYSEC-2026-3405 — vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

Affected: PyPI: vllm

## Summary

## Root Cause

`sampling_params.py:384`: ```python if 0 < self.temperature < _MAX_TEMP: # NaN → False; +Inf → False ```

`sampling_params.py:462`: ```python if self.temperature < 0.0: # NaN → False; +Inf → False raise VLLMValidationError(...) ```

No `math.isnan()` or `math.isinf()` check exists anywhere in `sampling_params.py`.

Python semantics (verified): `float('nan') < 0.0` → `False`, `float('inf') < 0.0` → `False`.

## Impact

Crash of inference worker on GPU kernel execution with NaN/Inf softmax input, degrading service for all concurrent users.

## Remediation

Add `math.isfinite(self.temperature)` check in `_verify_args()`. Reject non-finite float values with a 400 error.

## Fix

A fix for this vulnerability was merged here: https://github.com/vllm-project/vllm/pull/45116

RHSA-2026:36005 — Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (CUDA)

giflib: giflib: Denial of Service via buffer overflow in EGifGCBToExtension gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly vLLM: vLLM: Denial of Service due to excessive video frame processing vllm: vLLM: Denial of Service via excessively large 'n' parameter in OpenAI-compatible API vim: arbitrary command execution via modeline sandbox bypass vllm: vLLM: Arbitrary code execution via malicious HuggingFace model gnutls: gnutls: Denial of Service via DTLS packet reordering vulnerability gnutls: gnutls: Authentication Bypass via NUL Character in Username vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API access vllm: vLLM: Denial of Service due to improper floating-point validation starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

WID-SEC-W-2026-1897 — vllm: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in vllm ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.