medium6.5
CVE-2026-44222
vLLM is an inference and serving engine for large language models (LLMs).
Impact
vLLM is an inference and serving engine for large language models (LLMs). From 0.6.1 to before 0.20.0, there is a a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-only prompts that spell special tokens are interpreted as control. Image and video placeholder sequences supplied without matching data cause vLLM to index into empty grids during input-position computation, raising an unhandled IndexError and terminating the worker or degrading availability. Multimodal paths that rely on image_grid_thw/video_grid_thw are affected. This vulnerability is fixed in 0.20.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | vllm | >= 0.6.1, < 0.20.0 | 0.20.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vllm | Vllm | from 0.6.1 before 0.20.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-hpv8-x276-m59f
- https://github.com/vllm-project/vllm/security/advisories/GHSA-hpv8-x276-m59f
- https://github.com/vllm-project/vllm/issues/32656
- https://nvd.nist.gov/vuln/detail/CVE-2026-44222
- https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-3409.yaml
- https://github.com/vllm-project/vllm
- https://pypi.org/project/vllm