CVE-2026-54235Disclosure(vllm / vllm)

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch vllm vllm systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (<, >), which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagate to GPU sampling kernels, where they produce undefined behavior or CUDA errors that can crash the inference worker. This vulnerability is fixed in 0.23.1rc0.

vllm CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/vllm-project/vllm/commit/d598d239737cfa37bcfcb98886ec3f3557fc7198

Exploit / PoC references

https://github.com/vllm-project/vllm/security/advisories/GHSA-7h4p-rffg-7823

Other references

https://github.com/vllm-project/vllm/pull/45116

Weakness type (CWE)

CWE-1287

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

vllm

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Affected systems

Vendors

vllm

Products

vllm

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-54235 vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (<, >), which s… https://www.cve.org/CVERecord?id=CVE-2026-54235 ----- Traducción: CVE-2026-54235 vLL… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-54235 in vLLM, noting that before version 0.23.1rc0 temperature validation improperly used comparison operators, and that upgrading to 0.23.1rc0 addresses the issue.
0000038
88 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-54235 vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (<, >), which s… https://www.cve.org/CVERecord?id=CVE-2026-54235
Post summary
The post announces CVE‑2026‑54235 in vLLM, noting a validation flaw in versions prior to 0.23.1rc0, with no evidence of exploitation or mitigations.
00000725
57.7K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	vllm	vllm	-	-	-

Explore more

Back to dashboard vllm CVEs vllm vulnerabilities