{
  "affected": [
    {
      "affectedData": [
        {
          "product": "vllm",
          "vendor": "vllm-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.24.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0AF36274-AF6A-4915-8D2E-3603CF15D863",
              "versionEndExcluding": "0.24.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into the drafter\u0027s input ids; that out-of-vocabulary value is later consumed by the model\u0027s embedding and attention path and crashes the engine worker with a GPU device-side assertion. The same triggering request sequence is reachable through the public gRPC Generate and Abort endpoints, so a remote client that can send generation requests can crash the shared engine worker, aborting concurrent requests and causing a service-wide denial of service for other clients of the deployment until the worker is restarted. This issue is fixed in version 0.24.0."
    }
  ],
  "id": "CVE-2026-54234",
  "lastModified": "2026-07-07T19:04:17.300",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54234",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-07T14:12:43.565166Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-06T21:16:56.477",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/vllm-project/vllm/commit/8a5cf1ccd65e8ac7635c402c1ec0b08988bc26ca"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/vllm-project/vllm/pull/44744"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory",
        "Exploit"
      ],
      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-8wr5-jm2h-8r4f"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Vendor Advisory",
        "Exploit"
      ],
      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-8wr5-jm2h-8r4f"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-1284"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vllm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.17.1"
            },
            {
              "fixed": "0.24.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54234"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-17T17:08:03Z",
    "nvd_published_at": "2026-07-06T21:16:56Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nA frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to `vocab_size`, convert that value to `-1` when choosing the next live token for a request, and then feed that `-1` back into the next drafter input ids. On Qwen3 GPTQ this reaches the worker-side drafting / attention path and crashes the engine with a GPU `device-side assert`.\n\nThe same issue is reachable through the public gRPC request surface by sending a specific overlapping `Generate` / `Abort` sequence.\n\n## Impact\n\n- A remote client that can send public gRPC generation requests can crash the\n  shared vLLM engine worker\n- The triggering request sequence aborts concurrent requests and prevents later\n  requests from completing until the worker is restarted\n- In shared deployments, this is a service-wide denial of service for other\n  clients, not just a failure isolated to the attacking requests\n- The failure is reproducible, so repeated request sequences can sustain the\n  outage\n\n## Affected version\n\n- Confirmed on vLLM `0.17.1`\n- Earlier and later versions have not been checked yet in this report\n\n## Repro model\n\n- Official Hugging Face repo:\n  - [`Qwen/Qwen3-0.6B-GPTQ-Int8`](https://huggingface.co/Qwen/Qwen3-0.6B-GPTQ-Int8)\n- Anyone wants to reproduce the bug with my PoC scripts should download `Qwen3-0.6B-GPTQ-Int8` first\n\n## Trigger chain\n\n1. A legal multi-request speculative workload keeps structured-output state,\n   speculative decoding, overlap, and request cancellation active in the same\n   live engine.\n2. During rejection sampling, vLLM produces a recovered token equal to the\n   model `vocab_size` boundary value.\n3. That recovered token appears in position 0 of the sampled speculative row\n   for a live request. The same row also contains trailing padding entries\n   equal to `-1`, but those padding entries are not the key fault by\n   themselves.\n4. The next-token preparation step treats the position-0 recovered token as the\n   real next token for that request and converts that out-of-vocabulary value\n   to `-1`.\n5. The drafter writes that converted `-1` back into the live next-step input-id\n   row for the request.\n6. The drafting / embedding / attention path later consumes that live invalid\n   token and the worker crashes on GPU.\n\n## Details\n\n### Simple example\n\nThe important distinction is:\n\n- trailing `-1` values in a speculative row can be ordinary padding\n- the bug appears when the first live token for a request becomes\n  `151936 == vocab_size`, and that live token is then converted into `-1`\n\nIn simplified form, the bad transition looks like this:\n\n```text\nsampled speculative row:\n[151936, -1, -1, -1, ...]\n```\n\nAt this point, the trailing `-1` values are only padding. The critical problem\nis that the first position holds `151936`, which is out of vocabulary and is\nbeing treated as the request\u0027s real next token.\n\nThen vLLM prepares the next-token buffer:\n\n```text\nnext_token_ids:\n[-1, ...]\n```\n\nFinally, that converted `-1` is written back into the live model input ids:\n\n```text\ninput_ids_after:\n[-1, 0, 0, 0, ...]\n```\n\nThe crash happens because the live next token became `-1` and was later consumed by the drafting / embedding / attention path, not merely because the speculative row contained padded `-1` entries.\n\n### Trigger path in code\n\n1. The workload is frontend-legal. The requests use normal `SamplingParams`\n   features such as structured outputs, `stop`, `bad_words`, `min_tokens`, and\n   streaming overlap. No malformed token-id list is required at the request\n   boundary.\n2. In speculative decoding, the rejection sampler can generate recovered tokens\n   when drafted tokens are rejected.\n   ```python\n   # vllm/v1/sample/rejection_sampler.py\n   def sample_recovered_tokens(...):\n       recovered_token_ids = torch.empty_like(draft_token_ids)\n       sample_recovered_tokens_kernel[(batch_size, max_spec_len)](...)\n       return recovered_token_ids\n   ```\n   On the verified Qwen3 run, the recovered-token trace shows\n   `recovered_token_ids[0] = 151936`, which is exactly `vocab_size` for this\n   checkpoint.\n3. The speculative proposer then prepares the next-token row from the sampled\n   speculative row.\n   ```python\n   # vllm/v1/spec_decode/eagle.py\n   def prepare_next_token_ids_padded(...):\n       ...\n       eagle_prepare_next_token_padded_kernel[grid](\n           sampled_token_ids,\n           discard_request_mask,\n           backup_tokens_gpu,\n           next_token_ids,\n           valid_sampled_tokens_count,\n           gpu_input_batch.vocab_size,\n           ...\n       )\n       return next_token_ids, valid_sampled_tokens_count\n   ```\n   In the verified trace, this step receives a sampled row beginning with\n   `151936`, followed by `-1` padding. The important point is that `151936`\n   occupies the first live token position for the request. This step then\n   produces `next_token_ids[0] = -1`, meaning the live next token for the\n   request has been converted to `-1`.\n4. The drafter then rotates the draft input ids and inserts those\n   `next_token_ids` back into the live input-id buffer.\n   ```python\n   # vllm/v1/spec_decode/eagle.py\n   def set_inputs_first_pass(...):\n       ...\n       self.input_ids[token_indices_to_sample] = next_token_ids\n   ```\n   In the verified trace, this produces `input_ids_after[0] = -1`.\n5. The model-side embed path later consumes those input ids.\n   ```python\n   # vllm/model_executor/models/qwen2.py\n   def embed_input_ids(self, input_ids: torch.Tensor) -\u003e torch.Tensor:\n       return self.embed_tokens(input_ids)\n   ```\n   In the verified trace, this is the first point where the converted `-1`\n   becomes visible as a real model input. The bug is not merely that the\n   sampled speculative row contained padding `-1`; the bug is that the live\n   next token for the request became `-1` and was written back into input ids.\n6. After that point, the visible sink depends on timing and backend state. On\n   the attached Qwen3 reproducer, the engine commonly dies later in the\n   drafting / attention path with `CUDA error: device-side assert triggered`,\n   for example under `flash_attn_varlen_func(...)`.\n\n### Local script breakdown\n\n`repro_g4_recovered_minus1_local.py` is a standalone local reproducer.\n\n- It reads the Qwen3 checkpoint path from `VLLM_POC_G4_MODEL` or the built-in\n  `/path/to/qwen3` placeholder\n- It creates `EngineCore` directly without any external helper dependency\n- It submits one fixed multi-request workload that preserves the same overlap\n  and speculative-decoding state needed for the bug\n- It writes:\n  - `request_payloads.json`\n  - `repro_config.json`\n  - `timeline.json`\n  - `responses.json`\n  - `error.txt`\n  - `recovered_chain_trace.jsonl`\n- `recovered_chain_trace.jsonl` is the key attribution artifact. It records the\n  recovered-token chain directly from the standalone reproducer\n\n### gRPC script breakdown\n\n`repro_g4_recovered_minus1_grpc.py` is a standalone public gRPC reproducer.\n\n- It reads the Qwen3 checkpoint path from `VLLM_POC_G4_MODEL` or the built-in\n  `/path/to/qwen3` placeholder\n- It starts a temporary `vllm.entrypoints.grpc_server` process\n- It sends only public `Generate` and `Abort` RPCs\n- It submits one fixed overlapping request sequence that preserves the same\n  speculative-decoding state needed for the bug\n- After the crash window, it sends one more public `Generate` probe request to\n  confirm that later gRPC requests also fail after the worker dies\n- It writes:\n  - `request_payloads.json`\n  - `timeline.json`\n  - `server_command.json`\n  - `responses.json`\n  - `post_crash_probe.json`\n  - `server.stdout.log`\n  - `server.stderr.log`\n\n## Observed result\n\nLocal repro typically ends with:\n\n- a recovered-token trace showing:\n  - `sample_recovered_tokens_return -\u003e recovered_token_ids[0] = 151936`\n  - `prepare_next_token_ids_padded -\u003e next_token_ids[0] = -1`\n  - `set_inputs_first_pass -\u003e input_ids_after[0] = -1`\n  - `embed_input_ids_out_of_range -\u003e input_ids[0] = -1`\n- `CUDA error: device-side assert triggered`\n- a fatal engine-side failure\n\ngRPC repro typically ends with:\n\n- the triggering gRPC requests failing with\n  `INTERNAL: EngineCore encountered an issue. See stack trace (above) for the root cause.`\n- server logs showing the worker dies with\n  `CUDA error: device-side assert triggered`\n- a later public probe request also failing after the worker is dead\n\nThis demonstrates that the issue is reachable through the public gRPC request surface, not only through a local reproducer.\n\n## Log snippets\n\n### Local recovered-chain trace\n\n```text\nsample_recovered_tokens_return:\n  recovered_token_ids = [151936, ...]\n  vocab_size = 151936\n\nprepare_next_token_ids_padded:\n  sampled_token_ids_head = [[151936, -1, -1, ...], ...]\n  next_token_ids = [-1, ...]\n\nset_inputs_first_pass:\n  input_ids_after = [-1, 0, 0, 0, ...]\n\nembed_input_ids_out_of_range:\n  input_ids = [-1, 0, 0, 0, ...]\n```\n\n### gRPC server log\n\n```text\ntorch.AcceleratorError: CUDA error: device-side assert triggered\n...\nvllm.v1.engine.exceptions.EngineDeadError: EngineCore encountered an issue. See stack trace (above) for the root cause.\n...\nError in Generate for request post_crash_probe\nvllm.v1.engine.exceptions.EngineDeadError: EngineCore encountered an issue. See stack trace (above) for the root cause.\n```\n\n## Root cause\n\nThis is a speculative-decoding state-handling bug, not an invalid frontend token-id input bug.\n\nThe root cause is that a recovered speculative token can become equal to `vocab_size`, then be selected as the live next token for a request, then be converted to `-1`, and that converted `-1` is still written back into live drafter input ids and later consumed by the drafting / embedding / attention path.\n\nFor the Qwen3 checkpoint used here:\n\n- `151936 == vocab_size`\n\nThis value should be described as the model `vocab_size` boundary value, not as a legal token id.\n\n## Attachments\n\nThe attached bundle for this report should contain:\n\n- `repro_g4_recovered_minus1_local.py`\n- `repro_g4_recovered_minus1_grpc.py`\n\nThese two standalone scripts are sufficient to reproduce the issue and its public gRPC reachability.\n\n## Fix\n\nA fix for this vulnerability has been merged in: https://github.com/vllm-project/vllm/pull/44744",
  "id": "GHSA-8wr5-jm2h-8r4f",
  "modified": "2026-07-17T17:08:03Z",
  "published": "2026-07-17T17:08:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-8wr5-jm2h-8r4f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54234"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/pull/44744"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/commit/8a5cf1ccd65e8ac7635c402c1ec0b08988bc26ca"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vllm-project/vllm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vLLM has Remote DoS via Invalid Recovered Token Reinjection"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vllm",
        "purl": "pkg:pypi/vllm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.17.1"
            },
            {
              "fixed": "0.24.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.17.1",
        "0.18.0",
        "0.18.1",
        "0.19.0",
        "0.19.1",
        "0.20.0",
        "0.20.1",
        "0.20.2",
        "0.21.0",
        "0.22.0",
        "0.22.1",
        "0.23.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54234",
    "GHSA-8wr5-jm2h-8r4f"
  ],
  "details": "## Summary\n\nA frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to `vocab_size`, convert that value to `-1` when choosing the next live token for a request, and then feed that `-1` back into the next drafter input ids. On Qwen3 GPTQ this reaches the worker-side drafting / attention path and crashes the engine with a GPU `device-side assert`.\n\nThe same issue is reachable through the public gRPC request surface by sending a specific overlapping `Generate` / `Abort` sequence.\n\n## Impact\n\n- A remote client that can send public gRPC generation requests can crash the\n  shared vLLM engine worker\n- The triggering request sequence aborts concurrent requests and prevents later\n  requests from completing until the worker is restarted\n- In shared deployments, this is a service-wide denial of service for other\n  clients, not just a failure isolated to the attacking requests\n- The failure is reproducible, so repeated request sequences can sustain the\n  outage\n\n## Affected version\n\n- Confirmed on vLLM `0.17.1`\n- Earlier and later versions have not been checked yet in this report\n\n## Repro model\n\n- Official Hugging Face repo:\n  - [`Qwen/Qwen3-0.6B-GPTQ-Int8`](https://huggingface.co/Qwen/Qwen3-0.6B-GPTQ-Int8)\n- Anyone wants to reproduce the bug with my PoC scripts should download `Qwen3-0.6B-GPTQ-Int8` first\n\n## Trigger chain\n\n1. A legal multi-request speculative workload keeps structured-output state,\n   speculative decoding, overlap, and request cancellation active in the same\n   live engine.\n2. During rejection sampling, vLLM produces a recovered token equal to the\n   model `vocab_size` boundary value.\n3. That recovered token appears in position 0 of the sampled speculative row\n   for a live request. The same row also contains trailing padding entries\n   equal to `-1`, but those padding entries are not the key fault by\n   themselves.\n4. The next-token preparation step treats the position-0 recovered token as the\n   real next token for that request and converts that out-of-vocabulary value\n   to `-1`.\n5. The drafter writes that converted `-1` back into the live next-step input-id\n   row for the request.\n6. The drafting / embedding / attention path later consumes that live invalid\n   token and the worker crashes on GPU.\n\n## Details\n\n### Simple example\n\nThe important distinction is:\n\n- trailing `-1` values in a speculative row can be ordinary padding\n- the bug appears when the first live token for a request becomes\n  `151936 == vocab_size`, and that live token is then converted into `-1`\n\nIn simplified form, the bad transition looks like this:\n\n```text\nsampled speculative row:\n[151936, -1, -1, -1, ...]\n```\n\nAt this point, the trailing `-1` values are only padding. The critical problem\nis that the first position holds `151936`, which is out of vocabulary and is\nbeing treated as the request\u0027s real next token.\n\nThen vLLM prepares the next-token buffer:\n\n```text\nnext_token_ids:\n[-1, ...]\n```\n\nFinally, that converted `-1` is written back into the live model input ids:\n\n```text\ninput_ids_after:\n[-1, 0, 0, 0, ...]\n```\n\nThe crash happens because the live next token became `-1` and was later consumed by the drafting / embedding / attention path, not merely because the speculative row contained padded `-1` entries.\n\n### Trigger path in code\n\n1. The workload is frontend-legal. The requests use normal `SamplingParams`\n   features such as structured outputs, `stop`, `bad_words`, `min_tokens`, and\n   streaming overlap. No malformed token-id list is required at the request\n   boundary.\n2. In speculative decoding, the rejection sampler can generate recovered tokens\n   when drafted tokens are rejected.\n   ```python\n   # vllm/v1/sample/rejection_sampler.py\n   def sample_recovered_tokens(...):\n       recovered_token_ids = torch.empty_like(draft_token_ids)\n       sample_recovered_tokens_kernel[(batch_size, max_spec_len)](...)\n       return recovered_token_ids\n   ```\n   On the verified Qwen3 run, the recovered-token trace shows\n   `recovered_token_ids[0] = 151936`, which is exactly `vocab_size` for this\n   checkpoint.\n3. The speculative proposer then prepares the next-token row from the sampled\n   speculative row.\n   ```python\n   # vllm/v1/spec_decode/eagle.py\n   def prepare_next_token_ids_padded(...):\n       ...\n       eagle_prepare_next_token_padded_kernel[grid](\n           sampled_token_ids,\n           discard_request_mask,\n           backup_tokens_gpu,\n           next_token_ids,\n           valid_sampled_tokens_count,\n           gpu_input_batch.vocab_size,\n           ...\n       )\n       return next_token_ids, valid_sampled_tokens_count\n   ```\n   In the verified trace, this step receives a sampled row beginning with\n   `151936`, followed by `-1` padding. The important point is that `151936`\n   occupies the first live token position for the request. This step then\n   produces `next_token_ids[0] = -1`, meaning the live next token for the\n   request has been converted to `-1`.\n4. The drafter then rotates the draft input ids and inserts those\n   `next_token_ids` back into the live input-id buffer.\n   ```python\n   # vllm/v1/spec_decode/eagle.py\n   def set_inputs_first_pass(...):\n       ...\n       self.input_ids[token_indices_to_sample] = next_token_ids\n   ```\n   In the verified trace, this produces `input_ids_after[0] = -1`.\n5. The model-side embed path later consumes those input ids.\n   ```python\n   # vllm/model_executor/models/qwen2.py\n   def embed_input_ids(self, input_ids: torch.Tensor) -\u003e torch.Tensor:\n       return self.embed_tokens(input_ids)\n   ```\n   In the verified trace, this is the first point where the converted `-1`\n   becomes visible as a real model input. The bug is not merely that the\n   sampled speculative row contained padding `-1`; the bug is that the live\n   next token for the request became `-1` and was written back into input ids.\n6. After that point, the visible sink depends on timing and backend state. On\n   the attached Qwen3 reproducer, the engine commonly dies later in the\n   drafting / attention path with `CUDA error: device-side assert triggered`,\n   for example under `flash_attn_varlen_func(...)`.\n\n### Local script breakdown\n\n`repro_g4_recovered_minus1_local.py` is a standalone local reproducer.\n\n- It reads the Qwen3 checkpoint path from `VLLM_POC_G4_MODEL` or the built-in\n  `/path/to/qwen3` placeholder\n- It creates `EngineCore` directly without any external helper dependency\n- It submits one fixed multi-request workload that preserves the same overlap\n  and speculative-decoding state needed for the bug\n- It writes:\n  - `request_payloads.json`\n  - `repro_config.json`\n  - `timeline.json`\n  - `responses.json`\n  - `error.txt`\n  - `recovered_chain_trace.jsonl`\n- `recovered_chain_trace.jsonl` is the key attribution artifact. It records the\n  recovered-token chain directly from the standalone reproducer\n\n### gRPC script breakdown\n\n`repro_g4_recovered_minus1_grpc.py` is a standalone public gRPC reproducer.\n\n- It reads the Qwen3 checkpoint path from `VLLM_POC_G4_MODEL` or the built-in\n  `/path/to/qwen3` placeholder\n- It starts a temporary `vllm.entrypoints.grpc_server` process\n- It sends only public `Generate` and `Abort` RPCs\n- It submits one fixed overlapping request sequence that preserves the same\n  speculative-decoding state needed for the bug\n- After the crash window, it sends one more public `Generate` probe request to\n  confirm that later gRPC requests also fail after the worker dies\n- It writes:\n  - `request_payloads.json`\n  - `timeline.json`\n  - `server_command.json`\n  - `responses.json`\n  - `post_crash_probe.json`\n  - `server.stdout.log`\n  - `server.stderr.log`\n\n## Observed result\n\nLocal repro typically ends with:\n\n- a recovered-token trace showing:\n  - `sample_recovered_tokens_return -\u003e recovered_token_ids[0] = 151936`\n  - `prepare_next_token_ids_padded -\u003e next_token_ids[0] = -1`\n  - `set_inputs_first_pass -\u003e input_ids_after[0] = -1`\n  - `embed_input_ids_out_of_range -\u003e input_ids[0] = -1`\n- `CUDA error: device-side assert triggered`\n- a fatal engine-side failure\n\ngRPC repro typically ends with:\n\n- the triggering gRPC requests failing with\n  `INTERNAL: EngineCore encountered an issue. See stack trace (above) for the root cause.`\n- server logs showing the worker dies with\n  `CUDA error: device-side assert triggered`\n- a later public probe request also failing after the worker is dead\n\nThis demonstrates that the issue is reachable through the public gRPC request surface, not only through a local reproducer.\n\n## Log snippets\n\n### Local recovered-chain trace\n\n```text\nsample_recovered_tokens_return:\n  recovered_token_ids = [151936, ...]\n  vocab_size = 151936\n\nprepare_next_token_ids_padded:\n  sampled_token_ids_head = [[151936, -1, -1, ...], ...]\n  next_token_ids = [-1, ...]\n\nset_inputs_first_pass:\n  input_ids_after = [-1, 0, 0, 0, ...]\n\nembed_input_ids_out_of_range:\n  input_ids = [-1, 0, 0, 0, ...]\n```\n\n### gRPC server log\n\n```text\ntorch.AcceleratorError: CUDA error: device-side assert triggered\n...\nvllm.v1.engine.exceptions.EngineDeadError: EngineCore encountered an issue. See stack trace (above) for the root cause.\n...\nError in Generate for request post_crash_probe\nvllm.v1.engine.exceptions.EngineDeadError: EngineCore encountered an issue. See stack trace (above) for the root cause.\n```\n\n## Root cause\n\nThis is a speculative-decoding state-handling bug, not an invalid frontend token-id input bug.\n\nThe root cause is that a recovered speculative token can become equal to `vocab_size`, then be selected as the live next token for a request, then be converted to `-1`, and that converted `-1` is still written back into live drafter input ids and later consumed by the drafting / embedding / attention path.\n\nFor the Qwen3 checkpoint used here:\n\n- `151936 == vocab_size`\n\nThis value should be described as the model `vocab_size` boundary value, not as a legal token id.\n\n## Attachments\n\nThe attached bundle for this report should contain:\n\n- `repro_g4_recovered_minus1_local.py`\n- `repro_g4_recovered_minus1_grpc.py`\n\nThese two standalone scripts are sufficient to reproduce the issue and its public gRPC reachability.\n\n## Fix\n\nA fix for this vulnerability has been merged in: https://github.com/vllm-project/vllm/pull/44744",
  "id": "PYSEC-2026-3542",
  "modified": "2026-07-23T14:34:38.042882Z",
  "published": "2026-07-23T11:41:46.686181Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-8wr5-jm2h-8r4f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54234"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/pull/44744"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/commit/8a5cf1ccd65e8ac7635c402c1ec0b08988bc26ca"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vllm-project/vllm"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/vllm"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-8wr5-jm2h-8r4f"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vLLM has Remote DoS via Invalid Recovered Token Reinjection"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AI Inference Server 3.3.6 (Spyre) is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat\u00ae AI Inference Server",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:60363",
        "url": "https://access.redhat.com/errata/RHSA-2026:60363"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44222",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44222"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-47155",
        "url": "https://access.redhat.com/security/cve/CVE-2026-47155"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-53923",
        "url": "https://access.redhat.com/security/cve/CVE-2026-53923"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54234",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54234"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55574",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55574"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://www.redhat.com/en/products/ai/inference-server",
        "url": "https://www.redhat.com/en/products/ai/inference-server"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60363.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AI Inference Server 3.3.6 (Spyre)",
    "tracking": {
      "current_release_date": "2026-08-26T16:44:41+00:00",
      "generator": {
        "date": "2026-08-26T16:44:41+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:60363",
      "initial_release_date": "2026-08-26T16:25:47+00:00",
      "revision_history": [
        {
          "date": "2026-08-26T16:25:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-26T16:26:03+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-26T16:44:41+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat AI Inference Server 3.3",
                "product": {
                  "name": "Red Hat AI Inference Server 3.3",
                  "product_id": "Red Hat AI Inference Server 3.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ai_inference_server:3.3::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat AI Inference Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
                  "product_id": "registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vllm-spyre-rhel9@sha256%3Ae54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8?arch=ppc64le\u0026repository_url=registry.redhat.io/rhaiis/vllm-spyre-rhel9\u0026tag=1787161776"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
                "product": {
                  "name": "registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
                  "product_id": "registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vllm-spyre-rhel9@sha256%3A590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be?arch=s390x\u0026repository_url=registry.redhat.io/rhaiis/vllm-spyre-rhel9\u0026tag=1787161776"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64",
                "product": {
                  "name": "registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64",
                  "product_id": "registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vllm-spyre-rhel9@sha256%3Af3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0?arch=amd64\u0026repository_url=registry.redhat.io/rhaiis/vllm-spyre-rhel9\u0026tag=1787161776"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x as a component of Red Hat AI Inference Server 3.3",
          "product_id": "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x"
        },
        "product_reference": "registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le as a component of Red Hat AI Inference Server 3.3",
          "product_id": "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64 as a component of Red Hat AI Inference Server 3.3",
          "product_id": "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
        },
        "product_reference": "registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-44222",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2026-05-12T21:02:52.278811+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476840"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability allows unauthenticated attackers to cause a Denial of Service (DoS) by supplying image or video placeholder sequences without matching data, leading to an unhandled error and worker termination. Additionally, text-only prompts containing special tokens can be misinterpreted as control commands, potentially leading to unexpected behavior.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Denial of Service via malformed multimodal input or token injection",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability affecting vLLM, as integrated into Red Hat AI Inference Server, Red Hat OpenShift AI, and Red Hat Enterprise Linux AI. The flaw allows unauthenticated attackers to trigger worker termination and degrade service availability by submitting malformed multimodal input or text prompts containing specific token sequences. This impact is significant due to the potential for service disruption in AI inference workloads.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44222"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476840",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476840"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44222",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44222"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44222",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44222"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/issues/32656",
          "url": "https://github.com/vllm-project/vllm/issues/32656"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-hpv8-x276-m59f",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-hpv8-x276-m59f"
        }
      ],
      "release_date": "2026-05-12T19:57:25.336000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T16:25:47+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:60363",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:60363"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vllm: vLLM: Denial of Service via malformed multimodal input or token injection"
    },
    {
      "cve": "CVE-2026-47155",
      "cwe": {
        "id": "CWE-829",
        "name": "Inclusion of Functionality from Untrusted Control Sphere"
      },
      "discovery_date": "2026-06-22T23:00:54.705583+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491580"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). The revision pinning controls in vLLM do not consistently apply to all artifacts loaded for a model. This allows a deployment configured with specific revisions to still load dynamic code or other configuration files from an unpinned or default revision. This issue can lead to a supply-chain integrity compromise, where operators may unknowingly serve models with unreviewed or unintended behavior.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Supply-chain integrity issue due to inconsistent revision pinning controls",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this issue as having Moderate impact. The flaw is a supply-chain integrity issue when operators pin a HuggingFace model revision but vLLM may still load nested artifacts from an unpinned revision. It affects Red Hat AI Inference Server, Red Hat OpenShift AI, and Red Hat Enterprise Linux AI images that ship vLLM versions prior to 0.22.0. KServe control-plane components that bundle vLLM as a library are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-47155"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491580",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491580"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-47155",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-47155"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47155",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47155"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/commit/d26a28ab033697f55a1414b5b0435de7cd6045b6",
          "url": "https://github.com/vllm-project/vllm/commit/d26a28ab033697f55a1414b5b0435de7cd6045b6"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/pull/42616",
          "url": "https://github.com/vllm-project/vllm/pull/42616"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-3ww4-5jv9-j5gm",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-3ww4-5jv9-j5gm"
        },
        {
          "category": "external",
          "summary": "https://huntr.com/bounties/3f1e24c0-87d2-4f6c-a705-820f380879ac",
          "url": "https://huntr.com/bounties/3f1e24c0-87d2-4f6c-a705-820f380879ac"
        }
      ],
      "release_date": "2026-06-22T22:20:10.793000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T16:25:47+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:60363",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:60363"
        },
        {
          "category": "workaround",
          "details": "Upgrade to a vLLM build containing the fix (\u003e= 0.22.0) when available from Red Hat. Until then, only serve models from trusted registries, pin revisions explicitly, and review nested artifacts in model repositories before deployment.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vllm: vLLM: Supply-chain integrity issue due to inconsistent revision pinning controls"
    },
    {
      "cve": "CVE-2026-53923",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-06-22T23:00:51.742636+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491579"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM. Integer truncation of tensor dimensions in vLLM\u0027s GGUF dequantize kernels leads to partial tensor processing. This results in the output tensor retaining previously used GPU memory, which, in multi-tenant inference deployments, can expose sensitive tensor data from other users\u0027 requests. This constitutes an information disclosure vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Information disclosure via integer truncation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this issue as having Low impact for Red Hat AI products. The upstream issue is limited information disclosure via integer truncation in vLLM sampling parameters. Red Hat OpenShift AI, Red Hat AI Inference Server, and Red Hat Enterprise Linux AI images are not considered affected because untrusted clients cannot control the vulnerable parameters in supported deployment models.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-53923"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491579",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491579"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-53923",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53923"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53923",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53923"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/commit/f219788f91952827132fa4fdf916427cd20d225e",
          "url": "https://github.com/vllm-project/vllm/commit/f219788f91952827132fa4fdf916427cd20d225e"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/pull/44971",
          "url": "https://github.com/vllm-project/vllm/pull/44971"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-5jv2-g5wq-cmr4",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-5jv2-g5wq-cmr4"
        }
      ],
      "release_date": "2026-06-22T21:55:42.001000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T16:25:47+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:60363",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:60363"
        },
        {
          "category": "workaround",
          "details": "No mitigation is required for unaffected deployments. Restrict untrusted access to inference APIs as a general hardening measure.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "vllm: vLLM: Information disclosure via integer truncation"
    },
    {
      "cve": "CVE-2026-54234",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-07-06T21:01:59.789808+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497515"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, a high-throughput and memory-efficient inference and serving engine for Large Language Models (LLMs). A remote attacker can exploit this vulnerability by sending a specially crafted multi-request speculative decoding workload through public gRPC Generate and Abort endpoints. This malformed workload can cause the rejection sampler to produce an out-of-vocabulary token, which then crashes the engine worker. This leads to a service-wide Denial of Service (DoS) for all clients until the worker is restarted.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Denial of Service via malformed speculative decoding workload",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in vLLM, utilized by Red Hat AI Inference Server, Red Hat Enterprise Linux AI, and Red Hat OpenShift AI, allows a remote attacker to crash the engine worker. By sending a specially crafted multi-request speculative decoding workload to public gRPC endpoints, an attacker can trigger an out-of-vocabulary token, leading to a service-wide disruption for all connected clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54234"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497515",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497515"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54234",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54234"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54234",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54234"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/commit/8a5cf1ccd65e8ac7635c402c1ec0b08988bc26ca",
          "url": "https://github.com/vllm-project/vllm/commit/8a5cf1ccd65e8ac7635c402c1ec0b08988bc26ca"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/pull/44744",
          "url": "https://github.com/vllm-project/vllm/pull/44744"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-8wr5-jm2h-8r4f",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-8wr5-jm2h-8r4f"
        }
      ],
      "release_date": "2026-07-06T19:49:20.481000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T16:25:47+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:60363",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:60363"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to the vLLM inference engine\u0027s gRPC Generate and Abort endpoints. Configure firewall rules to limit incoming connections to trusted clients or internal networks only. This will prevent remote, unauthenticated attackers from sending malformed workloads and triggering a denial of service. If the service is exposed via a proxy or load balancer, ensure that access controls are in place at that layer.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vllm: vLLM: Denial of Service via malformed speculative decoding workload"
    },
    {
      "cve": "CVE-2026-55574",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-07-06T21:01:40.112117+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497509"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, a high-throughput and memory-efficient inference and serving engine for large language models (LLMs). A remote attacker could exploit this vulnerability by providing a specially crafted regular expression to the structured_outputs.regex API parameter. This adversarial regex, containing nested quantifiers, can cause an exponential expansion of the state-space in the grammar compiler, leading to an inference worker hanging indefinitely. This results in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Denial of Service via adversarial regular expression in structured outputs API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important denial of service vulnerability exists in vLLM, as utilized within Red Hat AI Inference Server and Red Hat OpenShift AI. This flaw allows a remote, unauthenticated attacker to cause an inference worker to hang indefinitely by submitting a specially crafted regular expression to the structured outputs API. The absence of complexity analysis for nested quantifiers in the regex compiler leads to an exponential state-space expansion, resulting in prolonged service disruption.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55574"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497509",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497509"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55574",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55574"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55574",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55574"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/commit/2b3006076c5e9bc4cda9e03e3641388de3c5c286",
          "url": "https://github.com/vllm-project/vllm/commit/2b3006076c5e9bc4cda9e03e3641388de3c5c286"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/pull/45118",
          "url": "https://github.com/vllm-project/vllm/pull/45118"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-rwxx-mrjm-wc2m",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-rwxx-mrjm-wc2m"
        }
      ],
      "release_date": "2026-07-06T20:05:31.003000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T16:25:47+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:60363",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:60363"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:590f1bb37f9c9abb51a6ff7f557b45f1dcfba2e4880de979290703c2e6de95be_s390x",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e54618292d1e6f1c9c959a42160bad3a153ca7e050665739d3ddd9dbfda541f8_ppc64le",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:f3dfb688e524f44f071f20954e454a91013a9c48f8cc59a32f7f402bb61d8ed0_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vllm: vLLM: Denial of Service via adversarial regular expression in structured outputs API"
    }
  ]
}