The vulnerability (CVE-2026-44223) in vLLM, an inference and serving engine for large language models, arises from an incorrect calculation of buffer size (CWE-131) in the extract_hidden_states speculative decoding proposer. Specifically, when sampling penalty parameters are used in any request within a batch, the engine returns a tensor with an incorrect shape after the first decode step, triggering a RuntimeError that crashes the EngineCore process. This crash can be triggered by a single request with a penalty parameter such as repetition_penalty set to 1.1. The flaw affects versions >= 0.18.0 and < 0.20.0 and is fixed in version 0.20.0.

The vulnerability causes a denial of service by crashing the EngineCore process when processing requests that include sampling penalty parameters. There is no indication of confidentiality or integrity impact. The CVSS v3.1 score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impact limited to availability (engine crash). There are no known exploits in the wild.

Upgrade to vLLM version 0.20.0 or later, where this vulnerability is fixed. No other official remediation or temporary workaround is indicated. Patch status is not explicitly stated beyond the fix in version 0.20.0, so users should verify the upgrade with the vendor or official release notes.