CVE-2026-54234
published 2026-07-06CVE-2026-54234: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.62%
47.3th percentile
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into the drafter's input ids; that out-of-vocabulary value is later consumed by the model's embedding and attention path and crashes the engine worker with a GPU device-side assertion. The same triggering request sequence is reachable through the public gRPC Generate and Abort endpoints, so a remote client that can send generation requests can crash the shared engine worker, aborting concurrent requests and causing a service-wide denial of service for other clients of the deployment until the worker is restarted. This issue is fixed in version 0.24.0.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
| rhaii | vllm-neuron-rhel9 | — | — |
| rhaii | vllm-rocm-rhel9 | — | — |
| rhaii | vllm-spyre-rhel9 | — | — |
| rhaii | vllm-tpu-rhel9 | — | — |
| rhaiis | vllm-cpu-rhel9 | — | — |
| rhaiis | vllm-cuda-rhel9 | — | — |
| rhaiis | vllm-neuron-rhel9 | — | — |
| rhaiis | vllm-rocm-rhel9 | — | — |
| rhaiis | vllm-spyre-rhel9 | — | — |
| rhaiis | vllm-tpu-rhel9 | — | — |
| rhelai3 | bootc-aws-cuda-rhel9 | — | — |
| rhelai3 | bootc-azure-cuda-rhel9 | — | — |
| rhelai3 | bootc-azure-rocm-rhel9 | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-gcp-cuda-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhoai | odh-llm-d-kv-cache-rhel9 | — | — |
| rhoai | odh-vllm-gaudi-rhel9 | — | — |
| vllm-project | vllm | < 0.24.0 | 0.24.0 |
| vllm | vllm | < 0.24.0 | 0.24.0 |
| vllm | vllm | >= 0.17.1 < 0.24.0 | 0.24.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
vllm: vLLM: Denial of Service via malformed speculative decoding workload
vendor_redhat·2026-07-06·CVSS 7.5
CVE-2026-54234 [HIGH] CWE-125 vllm: vLLM: Denial of Service via malformed speculative decoding workload
vllm: vLLM: Denial of Service via malformed speculative decoding workload
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into the drafter's input ids; that out-of-vocabulary value is later consumed by the model's embedding and attention path and crashes the engine worker with a GPU device-side assertion. The same triggering request sequence is reachable through the public gRPC Generate and Abort endpoints, so a remote client that can send generatio
GHSA
vLLM has Remote DoS via Invalid Recovered Token Reinjection
ghsa·2026-07-17
CVE-2026-54234 [HIGH] CWE-20 vLLM has Remote DoS via Invalid Recovered Token Reinjection
vLLM has Remote DoS via Invalid Recovered Token Reinjection
## Summary
A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to `vocab_size`, convert that value to `-1` when choosing the next live token for a request, and then feed that `-1` back into the next drafter input ids. On Qwen3 GPTQ this reaches the worker-side drafting / attention path and crashes the engine with a GPU `device-side assert`.
The same issue is reachable through the public gRPC request surface by sending a specific overlapping `Generate` / `Abort` sequence.
## Impact
- A remote client that can send public gRPC generation requests can crash the
shared vLLM engine worker
- The triggering request sequence aborts concurrent requests and prevents later
VulDB
vLLM up to 0.23.x Rejection Sampler input validation
vuldb·2026-07-06·CVSS 7.5
CVE-2026-54234 [HIGH] vLLM up to 0.23.x Rejection Sampler input validation
A vulnerability categorized as problematic has been discovered in vLLM up to 0.23.x. Impacted is an unknown function of the component Rejection Sampler. The manipulation results in improper input validation.
This vulnerability is cataloged as CVE-2026-54234. The attack may be launched remotely. There is no exploit available.
No detection rules found.
No public exploits indexed.
2026-07-06
Published