vLLM: vLLM Vulnerable to Remote DoS via Special-Token Placeholders
vLLM
More for vLLM RSS feed for vLLM
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Record
- CVE-2026-44222
- Affects
- vLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 12, 2026
- Source last modified
- July 17, 2026
Description
vLLM is an inference and serving engine for large language models (LLMs). From 0.6.1 to before 0.20.0, there is a a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-only prompts that spell special tokens are interpreted as control. Image and video placeholder sequences supplied without matching data cause vLLM to index into empty grids during input-position computation, raising an unhandled IndexError and terminating the worker or degrading availability. Multimodal paths that rely on image_grid_thw/video_grid_thw are affected. This vulnerability is fixed in 0.20.0.
Description quoted from the NVD record.
Who is affected
vLLM is software that runs AI language models so that other programs and people can send them questions and get answers. This flaw affects versions 0.6.1 up to (but not including) 0.20.0, in the part that handles prompts with images or video. Someone who does not need to log in can send a plain text prompt that spells out special markers for images or video without including any actual image or video. This makes vLLM hit an error it does not handle, which can stop part of the running service or make it slow or unavailable. This flaw is rated High.
What to do
- If someone in your organization installed or runs vLLM, that person should check which version is in use.
- If the version is
0.6.1or later but before0.20.0, they should update vLLM to0.20.0or later, which fixes this flaw. - If an IT provider or vendor runs vLLM for your organization, send them this advisory and ask when the update to
0.20.0will be done. - If you are not sure whether your organization uses vLLM, ask whoever set up your AI tools or servers.
Analysis written from the source record as of July 17, 2026 and reviewed before publishing.