vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters (CVE-2026-44223) | HOL Guard CVE