CVE-2026-54235: vLLM Temperature Validation DoS Vulnerability

Technical summary

The vulnerability stems from insufficient temperature parameter validation in vLLM's inference pipeline. The validation logic relies on comparison operators (<, >) to enforce bounds on the temperature parameter, but these operators evaluate to False when compared against NaN or positive Infinity per IEEE 754 semantics, allowing invalid values to bypass all guards. When these unvalidated parameters reach CUDA sampling kernels, they trigger undefined behavior or CUDA runtime errors, crashing the worker process. The root cause is treating float comparisons as foolproof without explicit NaN/Infinity checks. This affects the inference path used for nearly all LLM sampling operations.

Business impact

Availability impact is the primary concern: attackers can craft requests with malicious temperature values to crash inference workers, causing service disruptions and requiring manual restart of affected pods or instances. In multi-tenant or public-facing deployments, this becomes a denial-of-service vector. Integrity impact is limited to potential silent sampling misbehavior before a crash occurs, but no data breach or model corruption is expected. For organizations running vLLM in production, unpatched instances are vulnerable to availability attacks that degrade inference service quality.

Affected systems

vLLM versions prior to 0.23.1rc0 are vulnerable. This includes all stable releases up to 0.23.0 and earlier minor versions. Any deployment running vLLM for LLM inference—whether on-premises, cloud-hosted, or containerized—is potentially affected if not updated. The vulnerability does not depend on specific GPU vendor, though exploitation surfaces through GPU sampling kernels where the actual crash or undefined behavior manifests.

Exploitability

Exploitability is straightforward: an attacker with network access to a vLLM inference endpoint can send a request containing a temperature parameter set to NaN or positive infinity (e.g., via HTTP body or API parameters). No authentication bypass is required, and no complex race conditions or user interaction is necessary. The attack is deterministic and repeatable. Organizations exposing vLLM endpoints publicly without rate-limiting or request validation are at elevated risk. Exploitation does not require sophisticated tooling—basic HTTP clients suffice.

Remediation

Upgrade vLLM to version 0.23.1rc0 or later. If immediate patching is not feasible, implement request-level validation on API gateways or load balancers to reject temperature values outside the valid range (typically 0.0 to 2.0 or similar, depending on your sampling strategy) and explicitly reject NaN and infinity values. This acts as a temporary mitigation but is not a substitute for patching. Verify the upgrade path from your current version to 0.23.1rc0 against the official vLLM release notes.

Patch guidance

Update vLLM to 0.23.1rc0 or any later release. For containerized deployments, rebuild container images with the patched vLLM version and redeploy pods. For virtual machine or bare-metal deployments, use your package manager (pip, apt, etc.) to upgrade vLLM. No database migrations or configuration changes are required. After upgrade, validate that temperature parameters are correctly validated by submitting test requests with edge-case values (NaN, infinity) and confirming rejection or safe handling. Restart inference workers to ensure the new code is in use.

Detection guidance

Monitor inference worker logs and GPU error logs for CUDA runtime errors or segmentation faults coinciding with requests containing unusual temperature parameters. Inspect API request logs for temperature values that are not decimal numbers (look for 'NaN', 'inf', '-inf' in raw request bodies). Set up alerts for worker crashes correlated with inference requests. If you have access to vLLM metrics, track temperature parameter distributions and flag outliers. Network-level detection is limited without deep packet inspection, but host-level monitoring of CUDA errors is effective.

Why prioritize this

This vulnerability should be prioritized for patches within the next 1–2 weeks. Although CVSS is Medium (6.5), the availability impact is direct and easily triggered by unauthenticated network requests. The attack surface is broad for any public-facing vLLM endpoint, and the fix is a straightforward software upgrade with no breaking changes. Organizations relying on vLLM for production inference should treat this as high priority despite the medium CVSS score, because availability of LLM services directly impacts business operations.

Risk score, explained

CVSS 6.5 (Medium) reflects the combination of network-accessible attack surface (AV:N), low attack complexity (AC:L), no privilege required (PR:N), no user interaction (UI:N), and scope unchanged (S:U). The impact side shows no confidentiality loss (C:N) but low integrity and low availability impact (I:L/A:L). The score correctly penalizes the ease of triggering a crash but acknowledges that data confidentiality is not compromised. However, for production LLM inference workloads, the business criticality of availability often elevates the practical risk above the numerical score.

Frequently asked questions