CVE-2026-44223: vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters
Vulnerability summary
CVE-2026-44223 is a medium (CVSS 6.5) Incorrect Calculation of Buffer Size vulnerability in vllm-project vllm. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 12-05-2026PublishedVulnerability first disclosed.
- 22-06-2026Last modifiedVulnerability information updated.
Description
vLLM is an inference and serving engine for large language models (LLMs). From 0.18.0 to before 0.20.0, the extract_hidden_states speculative decoding proposer in vLLM returns a tensor with an incorrect shape after the first decode step, causing a RuntimeError that crashes the EngineCore process. The crash is triggered when any request in the batch uses sampling penalty parameters (repetition_penalty, frequency_penalty, or presence_penalty). A single request with a penalty parameter (e.g., "repetition_penalty": 1.1) is sufficient to crash the server. This vulnerability is fixed in 0.20.0.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
Increase +0.06 pp
From 0.37% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-131Incorrect Calculation of Buffer SizeThe product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
- CWE-704Incorrect Type Conversion or CastThe product does not correctly convert an object, resource, or structure from one type to a different type.
Affected systems
Chainguard8 products
- lmcache-cuda-12.8All versions (No fix recorded)
- py3.10-vllm-cuda-12.4All versions (No fix recorded)
- py3.10-vllm-cuda-12.9All versions (No fix recorded)
- py3.12-vllm-cuda-12.4All versions (No fix recorded)
- py3.12-vllm-cuda-12.9All versions (No fix recorded)
PyPI1 product
- vllm≥ 0.18.0, < 0.20.0
Vllm1 product
- vllm≥ 0.18.0, < 0.20.0
Vllm-project1 product
- vllm≥ 0.18.0, < 0.20.0
4 vendors · 11 products
References
6 links- github.com/vllm-project/vllm/security/advisories/GHSA-83vm-p52w-f9pwX Refsource CONFIRMWEBAdvisoryMitigationVendor Advisory
- github.com/vllm-project/vllmPACKAGE