CVE-2026-44222

vLLM: Remote DoS via Special-Token Placeholders

vLLM is an inference and serving engine for large language models (LLMs). From 0.6.1 to before 0.20.0, there is a a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-only prompts that spell special tokens are interpreted as control. Image and video placeholder sequences supplied without matching data cause vLLM to index into empty grids during input-position computation, raising an unhandled IndexError and terminating the worker or degrading availability. Multimodal paths that rely on image_grid_thw/video_grid_thw are affected. This vulnerability is fixed in 0.20.0.

Affected

vllm-project · vllm

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 GITHUB

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.46% chance of exploitation in the next 30 days, 38th percentile

Published

2026-05-12

Updated

2026-05-13

Proof-of-concept exploits (1)

• advisories/GHSA-hpv8-x276-m59f

Security advisories

• vllm-project/vllm/security/advisories/GHSA-hpv8-x276-m59f
• vllm-project/vllm/issues/32656

References

• CVE Record
• NVD entry