--- id: CVE-2026-44223 title: vLLM is an inference and serving engine for large language models (LLMs) summary: >- vLLM is an inference and serving engine for large language models (LLMs). From 0.18.0 to before 0.20.0, the extract_hidden_states speculative decoding proposer in vLLM returns a tensor with an incorrect shape after the first decode step,… severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-131 - CWE-704 - CWE-130 published: '2026-05-12' updated: '2026-06-22' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44223' references: - url: 'https://github.com/vllm-project/vllm/pull/38610' label: security-advisories@github.com - url: >- https://github.com/vllm-project/vllm/security/advisories/GHSA-83vm-p52w-f9pw label: security-advisories@github.com - url: 'https://github.com/vllm-project/vllm/pull/38610' label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://github.com/vllm-project/vllm/security/advisories/GHSA-83vm-p52w-f9pw label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44223.json - url: 'https://access.redhat.com/security/cve/CVE-2026-44223' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2476827' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-44223' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44223' - url: 'https://access.redhat.com/errata/RHSA-2026:57380' - url: 'https://access.redhat.com/errata/RHSA-2026:57389' - url: 'https://access.redhat.com/errata/RHSA-2026:57390' - url: 'https://access.redhat.com/errata/RHSA-2026:57387' - url: 'https://access.redhat.com/errata/RHSA-2026:59151' - url: 'https://access.redhat.com/errata/RHSA-2026:59144' - url: >- https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-145.yaml - url: 'https://github.com/vllm-project/vllm' - url: 'https://access.redhat.com/errata/RHSA-2026:69466' - url: 'https://access.redhat.com/errata/RHSA-2026:69467' - url: 'https://access.redhat.com/errata/RHSA-2026:69469' - url: 'https://access.redhat.com/errata/RHSA-2026:69464' - url: 'https://access.redhat.com/errata/RHSA-2026:70965' - url: 'https://access.redhat.com/errata/RHSA-2026:70979' - url: 'https://access.redhat.com/errata/RHSA-2026:70995' - url: 'https://access.redhat.com/errata/RHSA-2026:70969' tags: - nvd - csaf - vex - red-hat - osv - pip epss: 0.00426 epssPercentile: 0.34255 ingestedAt: '2026-06-29T13:24:34.843Z' vendor: Red Hat product: Red Hat Enterprise Linux AI 3.4 affected: - ai_inference_server - openshift_ai_rhoai - ai_inference_server 3.4 - enterprise_linux_ai 3.4 patched: - ai_inference_server 3.4 - enterprise_linux_ai 3.4 scores: nvd: 6.5 vendor: 7.5 osv: 6.5 aliases: - GHSA-83vm-p52w-f9pw - PYSEC-2026-145 ecosystem: pip --- ## Overview vLLM is an inference and serving engine for large language models (LLMs). From 0.18.0 to before 0.20.0, the extract_hidden_states speculative decoding proposer in vLLM returns a tensor with an incorrect shape after the first decode step, causing a RuntimeError that crashes the EngineCore process. The crash is triggered when any request in the batch uses sampling penalty parameters (repetition_penalty, frequency_penalty, or presence_penalty). A single request with a penalty parameter (e.g., "repetition_penalty": 1.1) is sufficient to crash the server. This vulnerability is fixed in 0.20.0. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:57380** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57380) - **RHSA-2026:57389** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57389) - **RHSA-2026:57390** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57390) - **RHSA-2026:57387** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57387) - **RHSA-2026:59151** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.4 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59151) - **RHSA-2026:59144** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.4 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59144) - **Red Hat VEX** · Important · affected: Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI) · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44223.json) - **RHSA-2026:69466** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69466) - **RHSA-2026:69467** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69467) - **RHSA-2026:69469** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69469) - **RHSA-2026:69464** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69464) - **RHSA-2026:70965** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70965) - **RHSA-2026:70979** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70979) - **RHSA-2026:70995** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70995) - **RHSA-2026:70969** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70969) ## Package advisory (CVE-2026-44223) Affected packages: - `vllm >= 0.18.0, < 0.20.0` Patched in: - `vllm 0.20.0` Source: https://osv.dev/vulnerability/GHSA-83vm-p52w-f9pw