CVE-2026-54235: vLLM temperature validation bypass for NaN and Infinity values

# CVE-2026-54235: vLLM temperature validation bypass for NaN and Infinity values

https://gcdradar.vercel.app/incidents/cve-2026-54235-vllm-temperature-validation-bypass-for-nan-an · AIR-2026-0766 · closed 2026-06-17

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-06-17
- AI role: Attack on AI
- Products: vLLM
- CVE ids: CVE-2026-54235
- CVSS: 6.9

## Summary

vLLM fails to properly validate NaN and positive Infinity temperature parameters due to standard float comparison limitations, propagating invalid values to GPU kernels and causing crashes. The issue is documented as a vendor advisory.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-06-22: CVE-2026-54235: vLLM is an inference and serving engine for large language models (LLMs). (https://nvd.nist.gov/vuln/detail/CVE-2026-54235)
- 2026-06-17: CVE-2026-54235: vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels (https://github.com/advisories/GHSA-7h4p-rffg-7823)

## Sources

- 2026-06-17 GitHub Advisory Database: CVE-2026-54235: vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels https://github.com/advisories/GHSA-7h4p-rffg-7823
- 2026-06-22 NVD: CVE-2026-54235: vLLM is an inference and serving engine for large language models (LLMs). https://nvd.nist.gov/vuln/detail/CVE-2026-54235

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.