A high-throughput and memory-efficient inference and serving engine for LLMs
[Security] Reject non-finite temperature and repetition_penalty values (#45116)
Signed-off-by: jperezde <jperezde@redhat.com>
Juan Pérez de Algaba committed
Jun 11, 2026 at 10:12 UTC
d598d239737cfa37bcfcb98886ec3f3557fc7198
2 files changed
+63
tests/samplers/test_non_finite_params.py
new
+51
@@ -0,0 +1,51 @@
1
+# SPDX-License-Identifier: Apache-2.0
2
+# SPDX-FileCopyrightText: Copyright contributors to the vLLM project
3
+"""Tests that non-finite float values (NaN, Inf) are rejected by
4
+SamplingParams validation, preventing them from propagating to GPU kernels.
5
+
6
+Addresses advisory GHSA-7h4p-rffg-7823.
7
+"""
8
+
9
+import math
10
+
11
+import pytest
12
+
13
+from vllm import SamplingParams
14
+from vllm.exceptions import VLLMValidationError
15
+
16
+
17
+class TestNonFiniteTemperature:
18
+ """Verify that NaN and Infinity temperature values are rejected."""
19
+
20
+ @pytest.mark.parametrize(
21
+ "value",
22
+ [float("nan"), float("inf"), float("-inf"), math.nan, math.inf],
23
+ ids=["nan", "inf", "-inf", "math.nan", "math.inf"],
24
+ )
25
+ def test_non_finite_temperature_rejected(self, value: float):
26
+ with pytest.raises(VLLMValidationError, match="temperature"):
27
+ SamplingParams(temperature=value)
28
+
29
+ def test_finite_temperature_accepted(self):
30
+ SamplingParams(temperature=0.0)
31
+ SamplingParams(temperature=0.5)
32
+ SamplingParams(temperature=1.0)
33
+ SamplingParams(temperature=2.0)
34
+
35
+
36
+class TestNonFiniteRepetitionPenalty:
37
+ """Verify that NaN and Infinity repetition_penalty values are rejected."""
38
+
39
+ @pytest.mark.parametrize(
40
+ "value",
41
+ [float("nan"), float("inf"), float("-inf"), math.nan, math.inf],
42
+ ids=["nan", "inf", "-inf", "math.nan", "math.inf"],
43
+ )
44
+ def test_non_finite_repetition_penalty_rejected(self, value: float):
45
+ with pytest.raises(ValueError, match="repetition_penalty"):
46
+ SamplingParams(repetition_penalty=value)
47
+
48
+ def test_finite_repetition_penalty_accepted(self):
49
+ SamplingParams(repetition_penalty=0.5)
50
+ SamplingParams(repetition_penalty=1.0)
51
+ SamplingParams(repetition_penalty=2.0)
vllm/sampling_params.py
+12
@@ -4,6 +4,7 @@
4
5
import copy
6
import json as json_mod
7
+import math
8
from dataclasses import field
9
from enum import Enum, IntEnum
10
from functools import cached_property
@@ -503,11 +504,22 @@ class SamplingParams(
504
raise ValueError(
505
f"frequency_penalty must be in [-2, 2], got {self.frequency_penalty}."
506
)
507
+ if not math.isfinite(self.repetition_penalty):
508
+ raise ValueError(
509
+ "repetition_penalty must be a finite number, "
510
+ f"got {self.repetition_penalty}."
511
+ )
512
if self.repetition_penalty <= 0.0:
513
raise ValueError(
514
"repetition_penalty must be greater than zero, got "
515
f"{self.repetition_penalty}."
516
)
517
+ if not math.isfinite(self.temperature):
518
+ raise VLLMValidationError(
519
+ f"temperature must be a finite number, got {self.temperature}.",
520
+ parameter="temperature",
521
+ value=self.temperature,
522
+ )
523
if self.temperature < 0.0:
524
raise VLLMValidationError(
525
f"temperature must be non-negative, got {self.temperature}.",