vLLM - sampling parameter validation: Temperature validation uses strict comparison operators, so boundary values slip

Impact

Temperature validation uses strict comparison operators, so boundary values slip through the gate silently. In a multi-tenant serving deployment this is a request-parameter validation gap rather than memory corruption, but it lets a caller push the engine into a sampling state the operator believed was fenced off - which matters where sampling parameters are part of a tenant-facing safety or cost control.

Who can reach it

Network. Any client able to submit a request with sampling parameters to the vLLM endpoint.

What to do

Upgrade to vLLM 0.23.1rc0 or later and roll the serving deployment. Cost: rolling restart of the inference tier; no driver or firmware change.

References

Related entries

• vLLM: audio input in chat completions skips the decode-duration limit, letting a small clip OOM the workerCVE-2026-57173 · vLLM (input_audio path in /v1/chat/completions, AudioMediaIO decode duration guard)Medium
• MLflow: missing permission check on runs/log-inputs lets any user forge another run's lineageCVE-2026-69146 · MLflow tracking server auth plugin (mlflow/server/auth, runs/log-inputs endpoint)Medium
• vLLM: request-selected video decoder backend allocates GPU memory outside the KV-cache budgetCVE-2026-69147 · vLLM (MediaConnector video backend selection / GPU memory budgeting)Medium
• vLLM: unbounded prompt array in /v1/completions lets one request exhaust the engineCVE-2026-73559 · vLLM OpenAI-compatible server (/v1/completions prompt list)Medium
• vLLM: MiMo-V2-Omni processor bypasses media allowlists, enabling SSRF and local file readsCVE-2026-73560 · vLLM MiMoV2OmniMultiModalProcessor (media fetching in transformers_utils/processors/mimo_v2_omni.py)Medium
• OpenShift AI dashboard: unauthorized Secret read exposes the cluster NGC API key and NIM pull secretCVE-2026-86332 · Red Hat OpenShift AI odh-dashboard (GET /api/nim-serving/:nimResource)Medium