Executive brief
vLLM, a high-throughput engine for serving large language models, is vulnerable to a remote denial-of-service attack. By sending a specially crafted text-only request that includes multimodal control tokens (like image or video placeholders) without providing the actual image or video data, an attacker can cause the system to crash. This results in service unavailability or reduced capacity until the affected worker is manually restarted.
Technical details
A Token Injection vulnerability exists in vLLM's multimodal input position computation, specifically within the rotary embedding layers. The functions `get_input_positions_tensor` and `_vl_get_input_positions_tensor` in `vllm/model_executor/layers/rotary_embedding.py` count vision tokens (e.g., `<|vision_start|>`) in a user's text prompt and use that count to index into `image_grid_thw` or `video_grid_thw` arrays. If a user provides these tokens in a text-only request without accompanying multimodal data, these arrays remain empty, leading to an unhandled `IndexError`. This crash terminates the worker process. The vulnerability is exploitable via OpenAI-compatible API endpoints and is fixed in version 0.20.0.
Affected products
- vllm-project vllm >= 0.6.1, < 0.20.0
Timeline
- 2026-04-27: disclosed: Initial disclosure to vllm-project
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-12: advisory: NVD published CVE-2026-44222
- 2026-05-05: patched: Patched in version 0.20.0