PatchTheCVECVE-2026-54234: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs
CVE-2026-54234 is a high-severity flaw (CVSS 7.5) affecting vllm. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into the drafter's input ids; that out-of-vocabulary val
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Last updated 2026-10-25 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-54234?
vllm: upgrade to 0.24.0. Exact commands for each OS are on this page.
Is CVE-2026-54234 being exploited?
CVE-2026-54234 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-54234 affect?
CVE-2026-54234 affects vllm. Severity is high (CVSS 7.5). vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the mo
How urgent is CVE-2026-54234?
Priority 49/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-55574 HIGH 7.5 UPGRADE vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs
- CVE-2026-55514 MEDIUM 6.5 UPGRADE vLLM is a library for LLM inference and serving
- CVE-2026-55646 MEDIUM 6.5 UPGRADE vLLM is an inference and serving engine for large language models
- CVE-2026-56340 HIGH 8.8 UPGRADE vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing
- CVE-2026-73560 MEDIUM 6.5 UPGRADE vLLM is an inference and serving engine for large language models