{"id":"CVE-2026-54235","aliases":["GHSA-7h4p-rffg-7823","PYSEC-2026-3405"],"url":"https://o3.security/vulnerability/CVE-2026-54235","summary":"vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels","details":"## Summary\n\nAll temperature validation gates use comparison operators (`<`, `>`), which silently evaluate to `False` for `NaN` and for positive `Infinity` in Python's IEEE 754 float semantics. Both values pass every guard and propagate to GPU sampling kernels, where they produce undefined behavior or CUDA errors that can crash the inference worker. Note: `-Infinity` is correctly caught.\n\n## Root Cause\n\n`sampling_params.py:384`:\n```python\nif 0 < self.temperature < _MAX_TEMP:  # NaN → False; +Inf → False\n```\n\n`sampling_params.py:462`:\n```python\nif self.temperature < 0.0:            # NaN → False; +Inf → False\n    raise VLLMValidationError(...)\n```\n\nNo `math.isnan()` or `math.isinf()` check exists anywhere in `sampling_params.py`.\n\nPython semantics (verified): `float('nan') < 0.0` → `False`, `float('inf') < 0.0` → `False`.\n\n\n## Impact\n\nCrash of inference worker on GPU kernel execution with NaN/Inf softmax input, degrading service for all concurrent users.\n\n## Remediation\n\nAdd `math.isfinite(self.temperature)` check in `_verify_args()`. Reject non-finite float values with a 400 error.\n\n## Fix\n\nA fix for this vulnerability was merged here: https://github.com/vllm-project/vllm/pull/45116","published":"2026-06-22T21:59:02.710Z","modified":"2026-10-21T02:58:32.497080213Z","cvss":null,"epss":{"score":0.0045,"percentile":0.38015,"asOf":"2026-09-12"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"vllm","fixedVersion":"0.24.0"}],"fix":{"url":"https://github.com/vllm-project/vllm/commit/d598d239737cfa37bcfcb98886ec3f3557fc7198","label":"vllm-project/vllm@d598d23"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54235.json"},{"type":"ADVISORY","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-7h4p-rffg-7823"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54235"},{"type":"FIX","url":"https://github.com/vllm-project/vllm/commit/d598d239737cfa37bcfcb98886ec3f3557fc7198"},{"type":"FIX","url":"https://github.com/vllm-project/vllm/pull/45116"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7h4p-rffg-7823"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-3405.yaml"},{"type":"PACKAGE","url":"https://github.com/vllm-project/vllm"},{"type":"WEB","url":"https://pypi.org/project/vllm"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:32.497080213Z"}}