Executive brief
vLLM is an open-source library used for serving large language and vision models. A vulnerability in how it processes certain image types allows an attacker to crash the entire server by sending a specially crafted 1x1 pixel image. This results in a complete service outage, requiring a manual restart of the engine to restore operations.
Technical details
A Denial of Service (DoS) vulnerability exists in vLLM's Idefics3 vision model implementation due to a tensor dimension mismatch. When the image processor receives a 1x1 pixel image in HWC (Height, Width, Channel) format, it incorrectly interprets the shape as CHW (Channel, Height, Width). This misinterpretation leads to an incorrect calculation of image patches, causing a 'RuntimeError: split_with_sizes' during a tensor split operation in 'vllm/model_executor/models/idefics3.py'. Because this exception is unhandled, it terminates the EngineCore process. The attack requires network access and low privileges to send a multimodal request. The issue is fixed in version 0.12.0.
Affected products
- vLLM Project vllm >= 0.6.4, < 0.12.0
Timeline
- 2026-01-10: advisory: NVD published date
- 2026-01-13: disclosed: GitHub Advisory published
- 2026-01-13: patched: GitHub Advisory reviewed and patch version 0.12.0 identified