PT-2026-37318 · Vllm · Vllm

Wumingzhilian · Published 2026-05-05 · Updated 2026-05-12 · CVE-2026-44222

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions vLLM versions 0.6.1 through 0.19.x

Description A Token Injection issue exists in the multimodal processing of vLLM. Unauthenticated, text-only prompts containing special tokens are interpreted as control commands. When image and video placeholder sequences are provided without corresponding data, the system attempts to index into empty grids during input-position computation. This triggers an unhandled IndexError in the get input positions tensor() and vl get input positions tensor() functions, which can terminate the worker or degrade service availability, leading to a remote Denial of Service. The issue specifically affects multimodal paths relying on image grid thw and video grid thw variables.

Recommendations Update to version 0.20.0. As a temporary workaround, restrict the use of the vl get input positions tensor() function or sanitize user inputs to prevent the injection of multimodal placeholder tokens in text-only prompts.

Fix

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2026-44222

GHSA-HPV8-X276-M59F

Affected Products

Vllm

References · 7

• https://github.com/vllm-project/vllm/security/advisories/GHSA-hpv8-x276-m59f · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hpv8-x276-m59f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44222 · Security Note
• https://github.com/vllm-project/vllm · Note
• https://github.com/vllm-project/vllm/issues/32656 · Note
• https://twitter.com/CVEnew/status/2054324049401266682 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1t5dfkb/resumen_diario_de_vulnerabilidades_06052026 · Reddit Post