CVE-2026-54235·Python vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.26% — higher than 18% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Update vLLM to version 0.23.1 or later to resolve temperature validation issues that can cause GPU sampling kernel crashes. The vulnerability allows invalid floating-point values (NaN and positive Infinity) to bypass validation checks and reach CUDA kernels, potentially causing worker process failures. Ensure your Python environment has the patched vLLM version installed before resuming LLM inference workloads.

sudo dnf update python3 && pip install --upgrade vllm>=0.23.1

How to check if you are affected

1. Check installed vLLM version: python3 -c "import vllm; print(vllm.__version__)"
2. Identify if vLLM is actively serving inference requests: ps aux | grep vllm
3. Search inference worker logs for CUDA errors or crashes: grep -i "cuda\|segfault\|undefined behavior" /var/log/vllm/*.log
4. Verify the fix by confirming version is >= 0.23.1: pip show vllm | grep Version

FAQ

Related Python CVEs

References

• https://github.com/vllm-project/vllm/commit/d598d239737cfa37bcfcb98886ec3f3557fc7198
• https://github.com/vllm-project/vllm/pull/45116
• https://github.com/vllm-project/vllm/security/advisories/GHSA-7h4p-rffg-7823