CVE-2026-54235

[CVE catalog]

Severity

Medium · CVSS 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Jun 11, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.45% · Oct 27, 2026

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). The temperature validation gates, which use comparison operators, incorrectly handle Not-a-Number (NaN) and positive Infinity values in Python's IEEE 754 float semantics. These invalid values can bypass validation and propagate to GPU sampling kernels, leading to undefined behavior or CUDA errors that can crash the inference worker. This could allow an attacker to cause a Denial of Service (DoS) by providing specially crafted input. vllm: vLLM: Denial of Service due to improper floating-point validation This Moderate impact flaw in vLLM, as used in Red Hat AI Inference Server, Red Hat OpenShift AI, and Red Hat Enterprise Linux AI, allows for a denial of service. Improper validation of floating-point values like Not-a-Number (NaN) or positive Infinity in temperature parameters can bypass security checks, leading to undefined behavior or CUDA errors that crash the inference worker. This could be exploited by providing specially crafted input to the LLM inference engine. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.