vLLM is an inference and serving engine for large language models (LLMs). From 0.18.0 to before 0.20.0, the extract_hidden_states speculative decoding proposer in vLLM returns a tensor with an incorrect shape after the first decode step, causing a RuntimeError that crashes the EngineCore process. The crash is triggered when any request in the batch uses sampling penalty parameters (repetition_penalty, frequency_penalty, or presence_penalty). A single request with a penalty parameter (e.g., "repetition_penalty": 1.1) is sufficient to crash the server. This vulnerability is fixed in 0.20.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vLLM is an inference and serving engine for large language models (LLMs). From 0.18.0 to before 0.20.0,
    the extract_hidden_states speculative decoding proposer in vLLM returns a tensor with an incorrect shape
    after the first decode step, causing a RuntimeError that crashes the EngineCore process. The crash is
    triggered when any request in the batch uses sampling penalty parameters (repetition_penalty,
    frequency_penalty, or presence_penalty). A single request with a penalty parameter (e.g.,
    "repetition_penalty": 1.1) is sufficient to crash the server. This vulnerability is fixed in 0.20.0.
    (CVE-2026-44223)

ID	Name	Product	Family	Type	Severity
476422	Chainguard: vllm-openai-cuda-12.9: security update to 0.28.0-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
476422	Chainguard: vllm-openai-cuda-12.9: security update to 0.28.0-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
441396	SCA: security update for vllm (GHSA-83vm-p52w-f9pw)	Tenable Cloud Security	SCA Checks	Local	medium
441396	SCA: security update for vllm (GHSA-83vm-p52w-f9pw)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-44223

medium

Tenable Plugins

medium

medium

medium

medium