{"id":"CVE-2026-44222","title":"vllm: vLLM: Denial of Service via malformed multimodal input or token injection (CVE-2026-44222)","summary":"A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability allows unauthenticated attackers to cause a Denial of Service (DoS) by supplying image or video placeholder sequences without ma…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-1285","vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","affected":["ai_inference_server","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","ai_inference_server 3.2","ai_inference_server 3.3"],"patched":["ai_inference_server 3.2","ai_inference_server 3.3"],"published":"2026-05-12","updated":"2026-10-02","sourceUpdated":"2026-10-02T19:19:13+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44222.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44222.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-44222"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476840"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44222"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44222"},{"url":"https://github.com/vllm-project/vllm/issues/32656"},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-hpv8-x276-m59f"},{"url":"https://access.redhat.com/errata/RHSA-2026:61627"},{"url":"https://access.redhat.com/errata/RHSA-2026:61629"},{"url":"https://access.redhat.com/errata/RHSA-2026:60363"},{"url":"https://github.com/advisories/GHSA-hpv8-x276-m59f"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-3409.yaml"},{"url":"https://github.com/vllm-project/vllm"},{"url":"https://pypi.org/project/vllm"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00414,"epssPercentile":0.35493,"aliases":["GHSA-hpv8-x276-m59f","PYSEC-2026-3409"],"ecosystem":"pip","scores":{"vendor":7.5,"osv":6.5},"ingestedAt":"2026-07-13T18:57:59.318Z","slug":"CVE-2026-44222","body":"## Overview\n\nA flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability allows unauthenticated attackers to cause a Denial of Service (DoS) by supplying image or video placeholder sequences without matching data, leading to an unhandled error and worker termination. Additionally, text-only prompts containing special tokens can be misinterpreted as control commands, potentially leading to unexpected behavior.\n\n## Vendor advisories\n\n- **RHSA-2026:61627** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61627)\n- **RHSA-2026:61629** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61629)\n- **RHSA-2026:60363** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60363)\n- **Red Hat VEX** · Important · affected: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux AI (RHEL AI) 3 · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44222.json)\n\n**vllm: vLLM: Denial of Service via malformed multimodal input or token injection** — rated Important by Red Hat. Released 2026-05-12, updated 2026-10-02.\n\nAffected:\n\n- Red Hat AI Inference Server\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\nFixed:\n\n- Red Hat AI Inference Server 3.2\n- Red Hat AI Inference Server 3.3\n\nNo fix planned:\n\n- Red Hat AI Inference Server\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n\nNot affected:\n\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nFor more information visit https://access.redhat.com/errata/RHSA-2026:61627 https://access.redhat.com/errata/RHSA-2026:61627\nFor more information visit https://access.redhat.com/errata/RHSA-2026:61629 https://access.redhat.com/errata/RHSA-2026:61629\nFor more information visit https://access.redhat.com/errata/RHSA-2026:60363 https://access.redhat.com/errata/RHSA-2026:60363\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-44222)\n\nAffected packages:\n\n- `vllm >= 0.6.1, < 0.20.0`\n\nPatched in:\n\n- `vllm 0.20.0`\n\nSource: https://osv.dev/vulnerability/GHSA-hpv8-x276-m59f","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":215244,"id":"CVE-2026-44222","ts":1791014459222,"field":"cvss","old":"6.5","new":"7.5"},{"seq":215243,"id":"CVE-2026-44222","ts":1791014459222,"field":"severity","old":"medium","new":"high"}]}