CVE-2026-44222: vLLM Vulnerable to Remote DoS via Special-Token Placeholders
(updated )
This report explains a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-only prompts that spell special tokens are interpreted as control. Image and video placeholder sequences supplied without matching data cause vLLM to index into empty grids during input-position computation, raising an unhandled IndexError and terminating the worker or degrading availability. Multimodal paths that rely on image_grid_thw/video_grid_thw are affected. Severity: High (remote DoS). Reproduced on vLLM 0.10.0 with Qwen2.5-VL.
References
- github.com/advisories/GHSA-hpv8-x276-m59f
- github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-3409.yaml
- github.com/vllm-project/vllm
- github.com/vllm-project/vllm/issues/32656
- github.com/vllm-project/vllm/security/advisories/GHSA-hpv8-x276-m59f
- nvd.nist.gov/vuln/detail/CVE-2026-44222
- pypi.org/project/vllm
Code Behaviors & Features
Detect and mitigate CVE-2026-44222 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →