The vulnerability in vLLM before 0.23.1rc0 involves improper validation of the temperature input parameter. The validation gates use less-than and greater-than operators that silently evaluate to False for NaN and positive Infinity values under Python's IEEE 754 float semantics. Consequently, these special float values bypass the validation checks and propagate to GPU sampling kernels, leading to undefined behavior or CUDA errors that can crash the inference worker. This is classified as CWE-1287 (Improper Validation of Specified Type of Input). The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). The issue is fixed in version 0.23.1rc0.

An attacker or malformed input providing NaN or positive Infinity as the temperature parameter can cause the inference worker to crash due to undefined behavior or CUDA errors in GPU sampling kernels. This results in denial of service of the inference engine. There is no indication of privilege escalation, data disclosure, or code execution.

Upgrade to vLLM version 0.23.1rc0 or later, where the temperature validation properly handles NaN and positive Infinity values. No other mitigation or workaround is indicated. Patch status is not explicitly confirmed in the advisory, but the fix is stated to be in 0.23.1rc0.